From 8717b9f7bab9fc6ae2b3c19a35d3a1f385e5793a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Sun, 29 Jul 2018 00:43:14 -0700 Subject: [PATCH 001/286] update yaml to remove table --- windows/security/index.yml | 62 +++++++++++++++++++++++--------------- 1 file changed, 37 insertions(+), 25 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index 05c303413e..e2e61a742b 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -16,9 +16,9 @@ metadata: ms.localizationpriority: high - author: brianlic-msft + author: mjcaparas - ms.author: brianlic + ms.author: macapara manager: brianlic @@ -58,16 +58,6 @@ sections: title: Identity and access management - - href: \windows\security\threat-protection\ - - html:

Stop cyberthreats and quickly identify and respond to breaches

- - image: - - src: https://docs.microsoft.com/media/common/i_threat-protection.svg - - title: Threat protection - - href: \windows\security\information-protection\ html:

Identify and secure critical data to prevent data loss

@@ -78,17 +68,39 @@ sections: title: Information protection -- title: Windows Defender Advanced Threat Protection + + - href: \windows\security\hardware-protection\ + + html:

Protect and maintain system integrity

+ + image: + + src: https://docs.microsoft.com/media/common/i_threat-protection.svg + + title: Hardware-based protection + +- title: + items: - - type: markdown - text: " - Prevent, detect, investigate, and respond to advanced threats. The following capabilities are available across multiple products that make up the Windows Defender ATP platform. -
 
- - - - - - - -
Attack surface reductionNext generation protectionEndpoint detection and responseAuto investigation and remediationSecurity posture
[Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows)

[Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

[Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

[Device restrictions](https://docs.microsoft.com/en-us/intune/device-restrictions-configure)

[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

[Network firewall](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

[Attack surface reduction controls](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)
[Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)

[Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus)

[Automated sandbox service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus)
[Alerts queue](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection)

[Historical endpoint data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection#machine-timeline)

[Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

[API and SIEM integration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

[Response orchestration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection)

[Forensic collection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection#collect-investigation-package-from-machines)

[Threat intelligence](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection)

[Advanced detonation and analysis service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#deep-analysis)
[Automated investigation and remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)

[Threat remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#how-threats-are-remediated)

[Manage automated investigations](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#manage-automated-investigations)

[Analyze automated investigation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#analyze-automated-investigations)
[Asset inventory](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Operating system baseline compliance](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Recommended improvement actions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Secure score](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection)

[Reporting and trends](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection)
" \ No newline at end of file + + - type: list + + style: cards + + className: cardsM + + columns: 3 + + items: + + - href: \windows\security\threat-protection\ + + html:

Stop cyberthreats and quickly identify and respond to breaches

+ + image: + + src: https://docs.microsoft.com/media/common/i_threat-protection.svg + + title: Threat protection + + From 139d9e008f096c9d3ebbb0294a27c2ee6c16234b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Sun, 29 Jul 2018 14:38:11 +0300 Subject: [PATCH 002/286] update yml --- windows/security/index.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index e2e61a742b..e40423177f 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -79,7 +79,7 @@ sections: title: Hardware-based protection -- title: +- title: Second row items: From 7cd7e470d32bef451ea0cc2306eb1df3a4db2b19 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Sun, 29 Jul 2018 15:36:17 +0300 Subject: [PATCH 003/286] fix indent --- windows/security/index.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index e40423177f..5d351f78d0 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -95,9 +95,9 @@ sections: - href: \windows\security\threat-protection\ - html:

Stop cyberthreats and quickly identify and respond to breaches

+ html:

Stop cyberthreats and quickly identify and respond to breaches

- image: + image: src: https://docs.microsoft.com/media/common/i_threat-protection.svg From 9e76a1ede38c46f0f59f7d8c2e2e909b07f56b63 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Jul 2018 11:56:35 +0300 Subject: [PATCH 004/286] new toc --- windows/security/threat-protection/TOC.md | 561 +++++++++++------- .../security/threat-protection/faketopic.md | 0 2 files changed, 331 insertions(+), 230 deletions(-) create mode 100644 windows/security/threat-protection/faketopic.md diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index b7ac65f33b..7f03f1788c 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -6,14 +6,28 @@ ## [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) -### [Windows Defender Security Center](windows-defender-atp/windows-defender-security-center-atp.md) -####Get started + +### [Get started](fake2.md) ##### [Minimum requirements](windows-defender-atp\minimum-requirements-windows-defender-advanced-threat-protection.md) ##### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) ##### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md) ##### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) ##### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) + +##### [Evaluate WDATP](evaluate.md) +###### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) +###### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) +###### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) +###### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) +###### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +###### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) +###### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) + + + + +### [Onboard and configure](onboard.md) #### [Onboard machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) ##### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md) ##### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md) @@ -29,146 +43,91 @@ ##### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) ##### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) -#### [Understand the portal ](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) +####[Configure ASR](configure1.md) + + + + +#### [Configure NGP](configure2.md) +##### [Windows Defender Antivirus](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) +###### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) +###### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) +####### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) + +###### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) +####### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) +######## [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) +####### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) +######## [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) +####### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) +######## [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) +######## [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) +######## [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) +######## [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) +######## [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) + +##### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) +###### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) +####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) +####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md) +####### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) +###### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) +###### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md) +###### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md) +###### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md) +###### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) +###### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) +##### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) + +##### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) +###### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) +###### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) +###### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) +###### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) +###### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) + + + + +####[Configure AutoIR](configure3.md) + + +####[Configure Settings](configure4.md) + + + + + + + +### [Windows Defender Security Center](windows-defender-atp/windows-defender-security-center-atp.md) +#### [Understand the portal / Windows Defender Security Center ](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) ##### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) ##### [View the Security operations dashboard](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) -##### [View the Secure Score dashboard and improve your secure score](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) + ##### [View the Threat analytics dashboard and take recommended mitigation actions](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) -####Investigate and remediate threats -#####Alerts queue -###### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) -###### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md) -###### [Investigate alerts](windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md) -###### [Investigate files](windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md) -###### [Investigate machines](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md) -###### [Investigate an IP address](windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md) -###### [Investigate a domain](windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md) -###### [Investigate a user account](windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md) -#####Machines list -###### [View and organize the Machines list](windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md) -###### [Manage machine group and tags](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) -###### [Alerts related to this machine](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) -###### [Machine timeline](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) -####### [Search for specific events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) -####### [Filter events from a specific date](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) -####### [Export machine timeline events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) -####### [Navigate between pages](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) -##### [Take response actions](windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md) -###### [Take response actions on a machine](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md) -####### [Collect investigation package](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) -####### [Run antivirus scan](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) -####### [Restrict app execution](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) -####### [Remove app restriction](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) -####### [Isolate machines from the network](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) -####### [Release machine from isolation](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) -####### [Check activity details in Action center](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) - -###### [Take response actions on a file](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md) -####### [Stop and quarantine files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) -####### [Remove file from quarantine](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) -####### [Block files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) -####### [Remove file from blocked list](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) -####### [Check activity details in Action center](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) -####### [Deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) -######## [Submit files for analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) -######## [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) -######## [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) ###### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) ####### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) ####### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) -#### [Use Automated investigation to investigate and remediate threats](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) -#### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) + + ####API and SIEM support -##### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) -###### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) -###### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md) -###### [Configure HP ArcSight to pull alerts](windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md) -###### [Windows Defender ATP alert API fields](windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md) -###### [Pull alerts using REST API](windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) -###### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md) - -##### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -###### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md) -###### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md) -###### [Python code examples](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md) -###### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) -##### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md) -###### [Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md) -#######Actor -######## [Get actor information](windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md) -######## [Get actor related alerts](windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md) -#######Alerts -######## [Get alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md) -######## [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md) -######## [Get alert related actor information](windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) -######## [Get alert related domain information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) -######## [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md) -######## [Get alert related IP information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) -######## [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) -########Domain -######### [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md) -######### [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md) -######### [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md) -######### [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) - -#######File -######## [Block file API](windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md) -######## [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md) -######## [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md) -######## [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md) -######## [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md) -######## [Get FileActions collection API](windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md) -######## [Unblock file API](windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md) - -#######IP -######## [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md) -######## [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md) -######## [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md) -######## [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md) -#######Machines -######## [Collect investigation package API](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md) -######## [Find machine information by IP](windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) -######## [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) -######## [Get FileMachineAction object API](windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md) -######## [Get FileMachineActions collection API](windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) -######## [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md) -######## [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md) -######## [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md) -######## [Get MachineAction object API](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md) -######## [Get MachineActions collection API](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md) -######## [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) -######## [Get package SAS URI API](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md) -######## [Isolate machine API](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md) -######## [Release machine from isolation API](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md) -######## [Remove app restriction API](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md) -######## [Request sample API](windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md) -######## [Restrict app execution API](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md) -######## [Run antivirus scan API](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md) -######## [Stop and quarantine file API](windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md) -#######User -######## [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md) -######## [Get user information](windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md) -######## [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md) -######## [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md) ####Reporting -##### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) + ####Check service health and sensor state ##### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) @@ -187,9 +146,7 @@ ###### [Configure advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md) -#####Permissions -###### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md) -###### [Create and manage machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md) + #####APIs ###### [Enable Threat intel](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md) @@ -212,129 +169,273 @@ ##### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) #### [Windows Defender Antivirus compatibility with Windows Defender ATP](windows-defender-atp\defender-compatibility-windows-defender-advanced-threat-protection.md) -### [Windows Defender Antivirus](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) + +### [Attack surface reduction](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) +#### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) +##### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) +##### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) +##### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) +##### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) +##### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) + +#### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) + + +#### [Exploit protection](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) +##### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) + +##### [Enable Exploit protection](windows-defender-exploit-guard\enable-exploit-protection.md) +##### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) +###### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) + +#### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) + +##### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) +##### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) +#### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) + +##### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) +##### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) + + + +##### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) +##### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) +##### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) + +### [Next gen protection](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) +#### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +##### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) +##### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) +##### [Configure and validate network connections](windows-defender-antivirus\configure-network-connections-windows-defender-antivirus.md) +##### [Enable the Block at First Sight feature](windows-defender-antivirus\configure-block-at-first-sight-windows-defender-antivirus.md) +##### [Configure the cloud block timeout period](windows-defender-antivirus\configure-cloud-block-timeout-period-windows-defender-antivirus.md) +#### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus\configure-protection-features-windows-defender-antivirus.md) +##### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus\detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) +##### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md) + + + +### [EDR](faketopic.md) +####Alerts queue +##### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) +##### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md) +##### [Investigate alerts](windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md) +##### [Investigate files](windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md) +##### [Investigate machines](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md) +##### [Investigate an IP address](windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md) +##### [Investigate a domain](windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md) +##### [Investigate a user account](windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md) + +####Machines list +##### [View and organize the Machines list](windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md) +##### [Manage machine group and tags](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) +##### [Alerts related to this machine](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) +##### [Machine timeline](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) +###### [Search for specific events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) +###### [Filter events from a specific date](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) +###### [Export machine timeline events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) +###### [Navigate between pages](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) + + +#### [Take response actions](windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md) +##### [Take response actions on a machine](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md) +###### [Collect investigation package](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) +###### [Run antivirus scan](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) +###### [Restrict app execution](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) +###### [Remove app restriction](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) +###### [Isolate machines from the network](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) +###### [Release machine from isolation](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) +###### [Check activity details in Action center](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) + +##### [Take response actions on a file](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md) +###### [Stop and quarantine files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) +###### [Remove file from quarantine](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) +###### [Block files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) +###### [Remove file from blocked list](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) +###### [Check activity details in Action center](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) +###### [Deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) +###### [Submit files for analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) +###### [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) +###### [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) + + + + +### [Automatic investigation and remediation](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) + + +### [View the Secure Score dashboard and improve your secure score](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) + + +### [Managment and APIs](management-apis.md) +#### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) +##### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) +##### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md) +##### [Configure HP ArcSight to pull alerts](windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md) +##### [Windows Defender ATP alert API fields](windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md) +##### [Pull alerts using REST API](windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md) + +#### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md) +##### [Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md) +######Actor +####### [Get actor information](windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md) +####### [Get actor related alerts](windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md) +######Alerts +####### [Get alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md) +####### [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md) +####### [Get alert related actor information](windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related domain information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related IP information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) +#######Domain +######## [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md) +######## [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md) +######## [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md) +######## [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) + +######File +####### [Block file API](windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md) +####### [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md) +####### [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md) +####### [Get FileActions collection API](windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md) +####### [Unblock file API](windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md) + +######IP +####### [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md) +####### [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md) +######Machines +####### [Collect investigation package API](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md) +####### [Find machine information by IP](windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) +####### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) +####### [Get FileMachineAction object API](windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md) +####### [Get FileMachineActions collection API](windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) +####### [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md) +####### [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md) +####### [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get MachineAction object API](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md) +####### [Get MachineActions collection API](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md) +####### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) +####### [Get package SAS URI API](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md) +####### [Isolate machine API](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md) +####### [Release machine from isolation API](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md) +####### [Remove app restriction API](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md) +####### [Request sample API](windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md) +####### [Restrict app execution API](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md) +####### [Run antivirus scan API](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md) +####### [Stop and quarantine file API](windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md) + + + +######User +####### [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md) +####### [Get user information](windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md) +####### [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md) + + + + +#### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md) +##### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md) +##### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md) +##### [Python code examples](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md) +##### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) + +#### [Reporting](reporting.md) +##### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) + +#### [Permissions](permissions.md) +##### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md) +##### [Create and manage machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md) + + + +### [Microsoft threat protection - need to make new page - put anchors inside for each integ](integration.md) +#### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) + + + + + + + + + + + + + + + + + + + + + + +### [Troubleshoot everything](troubleshoot.md) +#### [Review event logs and error codes to troubleshoot issues](windows-demanagement and apisfender-antivirus\troubleshoot-windows-defender-antivirus.md) + + + + + + + + + + + + + + + + + + + + + + + + + + + + +---------------------- + + #### [Windows Defender AV in the Windows Defender Security app](windows-defender-antivirus\windows-defender-security-center-antivirus.md) -#### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) - -#### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) -##### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) -#### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) -#### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) -##### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) -###### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) -##### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) -###### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) -##### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) -###### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) -###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) -###### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) -###### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) -###### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) - - -#### [Configure Windows Defender Antivirus features](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) -##### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -###### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) -###### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) -###### [Configure and validate network connections](windows-defender-antivirus\configure-network-connections-windows-defender-antivirus.md) -###### [Enable the Block at First Sight feature](windows-defender-antivirus\configure-block-at-first-sight-windows-defender-antivirus.md) -###### [Configure the cloud block timeout period](windows-defender-antivirus\configure-cloud-block-timeout-period-windows-defender-antivirus.md) -##### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus\configure-protection-features-windows-defender-antivirus.md) -###### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus\detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) -###### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md) ##### [Configure end-user interaction with Windows Defender AV](windows-defender-antivirus\configure-end-user-interaction-windows-defender-antivirus.md) ###### [Configure the notifications that appear on endpoints](windows-defender-antivirus\configure-notifications-windows-defender-antivirus.md) ###### [Prevent users from seeing or interacting with the user interface](windows-defender-antivirus\prevent-end-user-interaction-windows-defender-antivirus.md) ###### [Prevent or allow users to locally modify policy settings](windows-defender-antivirus\configure-local-policy-overrides-windows-defender-antivirus.md) -#### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) -##### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md) -###### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) -##### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) -##### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md) -##### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md) -##### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md) -##### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) -##### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) -#### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) - - -##### [Review event logs and error codes to troubleshoot issues](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) - - - -##### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) -###### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) -###### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) -###### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) -###### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) -###### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) - - - - - - - - - - - - - - - - ### [Windows Defender Exploit Guard](windows-defender-exploit-guard\windows-defender-exploit-guard.md) -#### [Evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) -##### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) + ##### [View Exploit Guard events](windows-defender-exploit-guard\event-views-exploit-guard.md) -#### [Exploit protection](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) -##### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) -##### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) -##### [Enable Exploit protection](windows-defender-exploit-guard\enable-exploit-protection.md) -##### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) -###### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) + + ##### [Memory integrity](windows-defender-exploit-guard\memory-integrity.md) ###### [Requirements for virtualization-based protection of code integrity](windows-defender-exploit-guard\requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) ###### [Enable virtualization-based protection of code integrity](windows-defender-exploit-guard\enable-virtualization-based-protection-of-code-integrity.md) -#### [Attack surface reduction](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) -#### [Evaluate Attack surface reduction](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) -#### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) -#### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) -#### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) -#### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) -#### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) -#### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) -#### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) -#### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) -#### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) -#### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) -#### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) - - - - -### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) - - - - - - -### [Windows Defender Application Guard](windows-defender-application-guard/wd-app-guard-overview.md) -#### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) -#### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -#### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) -#### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) -#### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) ## Other security features diff --git a/windows/security/threat-protection/faketopic.md b/windows/security/threat-protection/faketopic.md new file mode 100644 index 0000000000..e69de29bb2 From 2ef592547e04f91af3d8d9142e7d038797b11ef5 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Jul 2018 11:59:54 +0300 Subject: [PATCH 005/286] add topics --- windows/security/threat-protection/integration.md | 0 windows/security/threat-protection/management-apis.md | 0 windows/security/threat-protection/onboard.md | 0 windows/security/threat-protection/troubleshoot.md | 0 windows/security/threat-protection/windows-defender-atp/fake2.md | 0 5 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/threat-protection/integration.md create mode 100644 windows/security/threat-protection/management-apis.md create mode 100644 windows/security/threat-protection/onboard.md create mode 100644 windows/security/threat-protection/troubleshoot.md create mode 100644 windows/security/threat-protection/windows-defender-atp/fake2.md diff --git a/windows/security/threat-protection/integration.md b/windows/security/threat-protection/integration.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/security/threat-protection/management-apis.md b/windows/security/threat-protection/management-apis.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/security/threat-protection/onboard.md b/windows/security/threat-protection/onboard.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/security/threat-protection/troubleshoot.md b/windows/security/threat-protection/troubleshoot.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/security/threat-protection/windows-defender-atp/fake2.md b/windows/security/threat-protection/windows-defender-atp/fake2.md new file mode 100644 index 0000000000..e69de29bb2 From 9206b8a59c9742e87be7e37dcd3448c85dbf9882 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Jul 2018 13:20:37 +0300 Subject: [PATCH 006/286] fix yaml --- windows/security/index.yml | 62 +++++++++++++++----------------------- 1 file changed, 25 insertions(+), 37 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index 5d351f78d0..05c303413e 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -16,9 +16,9 @@ metadata: ms.localizationpriority: high - author: mjcaparas + author: brianlic-msft - ms.author: macapara + ms.author: brianlic manager: brianlic @@ -58,6 +58,16 @@ sections: title: Identity and access management + - href: \windows\security\threat-protection\ + + html:

Stop cyberthreats and quickly identify and respond to breaches

+ + image: + + src: https://docs.microsoft.com/media/common/i_threat-protection.svg + + title: Threat protection + - href: \windows\security\information-protection\ html:

Identify and secure critical data to prevent data loss

@@ -68,39 +78,17 @@ sections: title: Information protection - - - href: \windows\security\hardware-protection\ - - html:

Protect and maintain system integrity

- - image: - - src: https://docs.microsoft.com/media/common/i_threat-protection.svg - - title: Hardware-based protection - -- title: Second row - +- title: Windows Defender Advanced Threat Protection items: - - - type: list - - style: cards - - className: cardsM - - columns: 3 - - items: - - - href: \windows\security\threat-protection\ - - html:

Stop cyberthreats and quickly identify and respond to breaches

- - image: - - src: https://docs.microsoft.com/media/common/i_threat-protection.svg - - title: Threat protection - - + - type: markdown + text: " + Prevent, detect, investigate, and respond to advanced threats. The following capabilities are available across multiple products that make up the Windows Defender ATP platform. +
 
+ + + + + + + +
Attack surface reductionNext generation protectionEndpoint detection and responseAuto investigation and remediationSecurity posture
[Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows)

[Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

[Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

[Device restrictions](https://docs.microsoft.com/en-us/intune/device-restrictions-configure)

[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

[Network firewall](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

[Attack surface reduction controls](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)
[Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)

[Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus)

[Automated sandbox service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus)
[Alerts queue](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection)

[Historical endpoint data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection#machine-timeline)

[Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

[API and SIEM integration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

[Response orchestration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection)

[Forensic collection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection#collect-investigation-package-from-machines)

[Threat intelligence](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection)

[Advanced detonation and analysis service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#deep-analysis)
[Automated investigation and remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)

[Threat remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#how-threats-are-remediated)

[Manage automated investigations](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#manage-automated-investigations)

[Analyze automated investigation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#analyze-automated-investigations)
[Asset inventory](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Operating system baseline compliance](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Recommended improvement actions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Secure score](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection)

[Reporting and trends](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection)
" \ No newline at end of file From 3133b5ce81074ff3f5bdf195c2b0af91734a4e3f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Jul 2018 13:24:03 +0300 Subject: [PATCH 007/286] fix toc --- windows/security/threat-protection/TOC.md | 28 +++++++++++------------ 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 7f03f1788c..63eb1b04ad 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -8,21 +8,21 @@ ## [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) ### [Get started](fake2.md) -##### [Minimum requirements](windows-defender-atp\minimum-requirements-windows-defender-advanced-threat-protection.md) -##### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md) -##### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) -##### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md) -##### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) -##### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) +#### [Minimum requirements](windows-defender-atp\minimum-requirements-windows-defender-advanced-threat-protection.md) +#### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) +#### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md) +#### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) +#### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) -##### [Evaluate WDATP](evaluate.md) -###### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) -###### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) -###### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) -###### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) -###### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) -###### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) -###### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) +#### [Evaluate WDATP](evaluate.md) +##### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) +##### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) +##### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) +##### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) +##### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +##### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) +##### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) From 02cde9e3c0cfccd2f80056d1c99e55c9ec89effd Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Jul 2018 13:49:56 +0300 Subject: [PATCH 008/286] fixes --- windows/security/threat-protection/TOC.md | 110 ++++++++++++---------- 1 file changed, 58 insertions(+), 52 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 63eb1b04ad..ddf5ef420a 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -92,52 +92,8 @@ ####[Configure AutoIR](configure3.md) -####[Configure Settings](configure4.md) - - - - - - -### [Windows Defender Security Center](windows-defender-atp/windows-defender-security-center-atp.md) -#### [Understand the portal / Windows Defender Security Center ](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) -##### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) -##### [View the Security operations dashboard](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) - -##### [View the Threat analytics dashboard and take recommended mitigation actions](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) - - - - - - - - -###### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) -####### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) -####### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) - - - - -####API and SIEM support - - - - -####Reporting - - -####Check service health and sensor state -##### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) -##### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) -##### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) -##### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) -##### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) - - -####[Configure Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) +#### [Configure Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) #####General ###### [Update data retention settings](windows-defender-atp\data-retention-settings-windows-defender-advanced-threat-protection.md) ###### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md) @@ -162,12 +118,50 @@ ###### [Onboarding machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) ###### [Offboarding machines](windows-defender-atp\offboard-machines-windows-defender-advanced-threat-protection.md) -#### [Configure Windows Defender Security Center time zone settings](windows-defender-atp\time-settings-windows-defender-advanced-threat-protection.md) +##### [Configure Windows Defender Security Center time zone settings](windows-defender-atp\time-settings-windows-defender-advanced-threat-protection.md) + + + + +### [Windows Defender Security Center](windows-defender-atp/windows-defender-security-center-atp.md) +#### [Understand the portal / Windows Defender Security Center ](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) +##### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) +##### [View the Security operations dashboard](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) + +##### [View the Threat analytics dashboard and take recommended mitigation actions](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) +##### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) + + + + + + + +###### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) +####### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) +####### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) + + + + +####API and SIEM support + + + + +####Reporting + + + + + + + + + + + -#### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) -##### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) -#### [Windows Defender Antivirus compatibility with Windows Defender ATP](windows-defender-atp\defender-compatibility-windows-defender-advanced-threat-protection.md) ### [Attack surface reduction](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) @@ -387,6 +381,15 @@ ### [Troubleshoot everything](troubleshoot.md) #### [Review event logs and error codes to troubleshoot issues](windows-demanagement and apisfender-antivirus\troubleshoot-windows-defender-antivirus.md) +####[Check service health and sensor state](troubleshoot-sense.md) +##### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) +##### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) +##### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) +##### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) +##### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) + +#### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) +##### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) @@ -413,8 +416,6 @@ - ----------------------- #### [Windows Defender AV in the Windows Defender Security app](windows-defender-antivirus\windows-defender-security-center-antivirus.md) @@ -438,6 +439,11 @@ ###### [Enable virtualization-based protection of code integrity](windows-defender-exploit-guard\enable-virtualization-based-protection-of-code-integrity.md) + +#### [Windows Defender Antivirus compatibility with Windows Defender ATP](windows-defender-atp\defender-compatibility-windows-defender-advanced-threat-protection.md) + + + ## Other security features ### [The Windows Security app](windows-defender-security-center/windows-defender-security-center.md) #### [Customize the Windows Security app for your organization](windows-defender-security-center/wdsc-customize-contact-information.md) From 0e45b69d1373605dc3d56c477062d67e605be19e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Jul 2018 14:06:06 +0300 Subject: [PATCH 009/286] removed dont know --- windows/security/threat-protection/TOC.md | 37 ----------------------- 1 file changed, 37 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index ddf5ef420a..fbd3d8e0ab 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -407,43 +407,6 @@ - - - - - - - - - - - -#### [Windows Defender AV in the Windows Defender Security app](windows-defender-antivirus\windows-defender-security-center-antivirus.md) - - - - -##### [Configure end-user interaction with Windows Defender AV](windows-defender-antivirus\configure-end-user-interaction-windows-defender-antivirus.md) -###### [Configure the notifications that appear on endpoints](windows-defender-antivirus\configure-notifications-windows-defender-antivirus.md) -###### [Prevent users from seeing or interacting with the user interface](windows-defender-antivirus\prevent-end-user-interaction-windows-defender-antivirus.md) -###### [Prevent or allow users to locally modify policy settings](windows-defender-antivirus\configure-local-policy-overrides-windows-defender-antivirus.md) - - -### [Windows Defender Exploit Guard](windows-defender-exploit-guard\windows-defender-exploit-guard.md) - -##### [View Exploit Guard events](windows-defender-exploit-guard\event-views-exploit-guard.md) - - -##### [Memory integrity](windows-defender-exploit-guard\memory-integrity.md) -###### [Requirements for virtualization-based protection of code integrity](windows-defender-exploit-guard\requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) -###### [Enable virtualization-based protection of code integrity](windows-defender-exploit-guard\enable-virtualization-based-protection-of-code-integrity.md) - - - -#### [Windows Defender Antivirus compatibility with Windows Defender ATP](windows-defender-atp\defender-compatibility-windows-defender-advanced-threat-protection.md) - - - ## Other security features ### [The Windows Security app](windows-defender-security-center/windows-defender-security-center.md) #### [Customize the Windows Security app for your organization](windows-defender-security-center/wdsc-customize-contact-information.md) From 646dff2c6250e83a3e3f828229096251ef18e0a3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Jul 2018 14:31:41 +0300 Subject: [PATCH 010/286] fix errors --- windows/security/threat-protection/TOC.md | 2 +- windows/security/threat-protection/configure1.md | 0 windows/security/threat-protection/configure2.md | 0 windows/security/threat-protection/configure3.md | 0 windows/security/threat-protection/evaluate.md | 0 windows/security/threat-protection/fake2.md | 0 windows/security/threat-protection/permissions.md | 0 windows/security/threat-protection/reporting.md | 0 windows/security/threat-protection/troubleshoot-sense.md | 0 9 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 windows/security/threat-protection/configure1.md create mode 100644 windows/security/threat-protection/configure2.md create mode 100644 windows/security/threat-protection/configure3.md create mode 100644 windows/security/threat-protection/evaluate.md create mode 100644 windows/security/threat-protection/fake2.md create mode 100644 windows/security/threat-protection/permissions.md create mode 100644 windows/security/threat-protection/reporting.md create mode 100644 windows/security/threat-protection/troubleshoot-sense.md diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index fbd3d8e0ab..af377a1af5 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -379,7 +379,7 @@ ### [Troubleshoot everything](troubleshoot.md) -#### [Review event logs and error codes to troubleshoot issues](windows-demanagement and apisfender-antivirus\troubleshoot-windows-defender-antivirus.md) +#### [Review event logs and error codes to troubleshoot issues](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) ####[Check service health and sensor state](troubleshoot-sense.md) ##### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/configure1.md b/windows/security/threat-protection/configure1.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/security/threat-protection/configure2.md b/windows/security/threat-protection/configure2.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/security/threat-protection/configure3.md b/windows/security/threat-protection/configure3.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/security/threat-protection/evaluate.md b/windows/security/threat-protection/evaluate.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/security/threat-protection/fake2.md b/windows/security/threat-protection/fake2.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/security/threat-protection/permissions.md b/windows/security/threat-protection/permissions.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/security/threat-protection/reporting.md b/windows/security/threat-protection/reporting.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/security/threat-protection/troubleshoot-sense.md b/windows/security/threat-protection/troubleshoot-sense.md new file mode 100644 index 0000000000..e69de29bb2 From 4556fc3337b45298074583f59947ffcb23c87431 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Jul 2018 14:51:23 +0300 Subject: [PATCH 011/286] moved advanced hunting --- windows/security/threat-protection/TOC.md | 25 ++++------------------- 1 file changed, 4 insertions(+), 21 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index af377a1af5..7d0397e3c6 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -137,27 +137,6 @@ -###### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) -####### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) -####### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) - - - - -####API and SIEM support - - - - -####Reporting - - - - - - - - @@ -255,6 +234,10 @@ +#### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) +##### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) +##### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) + ### [Automatic investigation and remediation](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) From 135ca4348327f7f394119f596c317c4c21a11a37 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Jul 2018 15:08:22 +0300 Subject: [PATCH 012/286] updates --- windows/security/threat-protection/TOC.md | 37 +++++++++++------------ 1 file changed, 18 insertions(+), 19 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 7d0397e3c6..a2056d0d86 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -48,23 +48,22 @@ -#### [Configure NGP](configure2.md) -##### [Windows Defender Antivirus](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) -###### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) -###### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) -####### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) +#### [Configure NGP](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) +##### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) +##### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) +###### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) -###### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) -####### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) -######## [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) -####### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) -######## [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) -####### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) -######## [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) -######## [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) -######## [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) -######## [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) -######## [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) +##### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) +###### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) +####### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) +###### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) +####### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) +###### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) +####### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) +####### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) +####### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) +####### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) +####### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) ##### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) ###### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) @@ -78,7 +77,6 @@ ###### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) ###### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) ##### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) - ##### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) ###### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) ###### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) @@ -89,11 +87,12 @@ -####[Configure AutoIR](configure3.md) + +####[Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) -#### [Configure Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) +#### [Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) #####General ###### [Update data retention settings](windows-defender-atp\data-retention-settings-windows-defender-advanced-threat-protection.md) ###### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md) From 85e6d7b2515c69f3efd92516728f4feb917150e6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 11:01:03 +0300 Subject: [PATCH 013/286] new changes --- windows/security/index.yml | 2 +- windows/security/threat-protection/TOC.md | 72 ++++++++++--------- .../security/threat-protection/configure1.md | 16 +++++ .../security/threat-protection/configure3.md | 18 +++++ .../security/threat-protection/integration.md | 20 ++++++ .../threat-protection/management-apis.md | 26 +++++++ windows/security/threat-protection/onboard.md | 16 +++++ .../threat-protection/troubleshoot-sense.md | 18 +++++ ...ows-defender-advanced-threat-protection.md | 2 +- ...ows-defender-advanced-threat-protection.md | 6 +- ...ows-defender-advanced-threat-protection.md | 2 +- 11 files changed, 161 insertions(+), 37 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index 05c303413e..c06e4aad88 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -85,7 +85,7 @@ sections: Prevent, detect, investigate, and respond to advanced threats. The following capabilities are available across multiple products that make up the Windows Defender ATP platform.
 
- + diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index a2056d0d86..2340e23606 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -15,20 +15,20 @@ #### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) -#### [Evaluate WDATP](evaluate.md) -##### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) +#### [Evaluate Windows Defender ATP](evaluate.md) +##### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) ##### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) ##### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) ##### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) -##### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +##### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) ##### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) ##### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) +##### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) - -### [Onboard and configure](onboard.md) -#### [Onboard machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) +### [Onboard and configure machines to Windows Defender ATP](onboard.md) +#### [Onboard machines - need to revise this page](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) ##### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md) ##### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md) ###### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md) @@ -43,12 +43,21 @@ ##### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) ##### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) + + + + ####[Configure ASR](configure1.md) +##### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) +##### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) +##### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) -#### [Configure NGP](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) + + +#### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) ##### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) ##### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) ###### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) @@ -88,7 +97,7 @@ -####[Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) +#### [Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) @@ -122,13 +131,11 @@ -### [Windows Defender Security Center](windows-defender-atp/windows-defender-security-center-atp.md) -#### [Understand the portal / Windows Defender Security Center ](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) -##### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) -##### [View the Security operations dashboard](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) +### [Windows Defender Security Center](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) +#### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) +#### [View the Security operations dashboard - consdier moving to the relevant pillar](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) -##### [View the Threat analytics dashboard and take recommended mitigation actions](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) -##### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) +#### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) @@ -142,21 +149,16 @@ -### [Attack surface reduction](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) +### [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) #### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) -##### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) -##### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -##### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) -##### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) ##### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) - #### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) -#### [Exploit protection](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) +#### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) ##### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) -##### [Enable Exploit protection](windows-defender-exploit-guard\enable-exploit-protection.md) +##### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) ##### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) ###### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) @@ -175,7 +177,7 @@ ##### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) ##### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) -### [Next gen protection](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) +### [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) #### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) ##### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) ##### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) @@ -188,7 +190,7 @@ -### [EDR](faketopic.md) +### [Endpoint detection and response - Tomer B.](faketopic.md) ####Alerts queue ##### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) ##### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md) @@ -238,13 +240,16 @@ ##### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) -### [Automatic investigation and remediation](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) +### [Automatic investigation and remediation - Benny](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) -### [View the Secure Score dashboard and improve your secure score](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) +###Security posture +#### [Secure posture - Evald](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) +#### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) -### [Managment and APIs](management-apis.md) + +### [Management and APIs](management-apis.md) #### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) ##### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) ##### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md) @@ -336,7 +341,7 @@ -### [Microsoft threat protection - need to make new page - put anchors inside for each integ](integration.md) +### [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](integration.md) #### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) @@ -360,18 +365,19 @@ -### [Troubleshoot everything](troubleshoot.md) -#### [Review event logs and error codes to troubleshoot issues](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) +###Troubleshoot Windows Defender ATP +#### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) -####[Check service health and sensor state](troubleshoot-sense.md) +####Troubleshoot sensor state - Ask Heike name of sensor ##### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) ##### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) ##### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) ##### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) -##### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) +##### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) #### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) -##### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) +##### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) + diff --git a/windows/security/threat-protection/configure1.md b/windows/security/threat-protection/configure1.md index e69de29bb2..37062fcdb7 100644 --- a/windows/security/threat-protection/configure1.md +++ b/windows/security/threat-protection/configure1.md @@ -0,0 +1,16 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# To do: Amitai and Andrea and Justin diff --git a/windows/security/threat-protection/configure3.md b/windows/security/threat-protection/configure3.md index e69de29bb2..ecfb414741 100644 --- a/windows/security/threat-protection/configure3.md +++ b/windows/security/threat-protection/configure3.md @@ -0,0 +1,18 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# TO do: Benny and joey to write this topic + +You can configure it through the portal, see Settings \ No newline at end of file diff --git a/windows/security/threat-protection/integration.md b/windows/security/threat-protection/integration.md index e69de29bb2..6c22bd96e1 100644 --- a/windows/security/threat-protection/integration.md +++ b/windows/security/threat-protection/integration.md @@ -0,0 +1,20 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# TO do: Heike, Alon, or Raviv + +These are all the products that WDATP integrates with then link to their documentation. + +Have links to the different configuration settings and put links there. \ No newline at end of file diff --git a/windows/security/threat-protection/management-apis.md b/windows/security/threat-protection/management-apis.md index e69de29bb2..44ff4dfc98 100644 --- a/windows/security/threat-protection/management-apis.md +++ b/windows/security/threat-protection/management-apis.md @@ -0,0 +1,26 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# To do: Raviv + +Talk about all the tools that you can use with WDATP + +OR one liner + +wdatp allows you to interact with the platform and other systems + +enable to manage and interact with the system + +APIs, SIEM connectors, Reporting, powerbi, etc \ No newline at end of file diff --git a/windows/security/threat-protection/onboard.md b/windows/security/threat-protection/onboard.md index e69de29bb2..f9ac29a1f8 100644 --- a/windows/security/threat-protection/onboard.md +++ b/windows/security/threat-protection/onboard.md @@ -0,0 +1,16 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# TO do: naama and joey to write this topic \ No newline at end of file diff --git a/windows/security/threat-protection/troubleshoot-sense.md b/windows/security/threat-protection/troubleshoot-sense.md index e69de29bb2..bcc523b5a6 100644 --- a/windows/security/threat-protection/troubleshoot-sense.md +++ b/windows/security/threat-protection/troubleshoot-sense.md @@ -0,0 +1,18 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# TO do: Heike + +What do you want to call sense \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md index a59d266c4b..3d8ae4ab64 100644 --- a/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md @@ -23,7 +23,7 @@ ms.date: 05/21/2018 - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) - +BENNY: look at this page and see if there are "settings/ configurations" if yes, point them to the settings page and remove it from here. >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink) diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md index 97d408e645..3c6c0f6222 100644 --- a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md @@ -18,7 +18,11 @@ ms.date: 07/01/2018 **Applies to:** - Windows Defender Advanced Threat Protection (Windows Defender ATP) -You need to onboard machines to Windows Defender ATP before you can use the service. +You need to turn on the sensor to give visibility within Windows Defender ATP. + +JOEY: LOOK INTO THIS AGAIN - REVISE +OWNER: NAAMA + For more information, see [Onboard your Windows 10 machines to Windows Defender ATP](https://www.youtube.com/watch?v=JT7VGYfeRlA&feature=youtu.be). diff --git a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md index 769e84dfb8..da8569a91a 100644 --- a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md @@ -32,7 +32,7 @@ Use the **Settings** menu to modify general settings, advanced features, enable Topic | Description :---|:--- -[Update general settings](data-retention-settings-windows-defender-advanced-threat-protection.md) | Modify your general settings that were previously defined as part of the onboarding process. +General settings | Modify your general settings that were previously defined as part of the onboarding process. Permissions | Manage portal access using RBAC as well as machine groups. APIs | Enable the threat intel and SIEM integration. Rules | Configure suppressions rules and automation settings. From 55a8cb56299083592c2852588e3541193d0ff4a8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 13:26:16 +0300 Subject: [PATCH 014/286] new toc --- .../windows-defender-atp/TOC.md | 1112 ++++++++++++++--- 1 file changed, 938 insertions(+), 174 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 193fddfef8..7122f7a162 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -1,203 +1,967 @@ -# [Windows Defender Security Center](windows-defender-security-center-atp.md) -##Get started -### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) -### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) -### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) -### [Preview features](preview-windows-defender-advanced-threat-protection.md) -### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) -### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) -## [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md) -### [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md) -### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) -#### [Onboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) -#### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -#### [Onboard machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -##### [Onboard machines using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-windows-10-machines-using-microsoft-intune) -#### [Onboard machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) -#### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) -### [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md) -### [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) -### [Run a detection test on a newly onboarded machine](run-detection-test-windows-defender-advanced-threat-protection.md) -### [Run simulated attacks on machines](attack-simulations-windows-defender-advanced-threat-protection.md) -### [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) -### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) -## [Understand the portal](use-windows-defender-advanced-threat-protection.md) -### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) -### [View the Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md) -### [View the Secure Score dashboard and improve your secure score](secure-score-dashboard-windows-defender-advanced-threat-protection.md) -### [View the Threat analytics dashboard and take recommended mitigation actions](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) +# [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) -##Investigate and remediate threats +## [Get started](fake2.md) +### [Minimum requirements](windows-defender-atp\minimum-requirements-windows-defender-advanced-threat-protection.md) +### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md) +### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) +### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md) +### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) +### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) + +### [Evaluate Windows Defender ATP](evaluate.md) +#### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +#### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) +#### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) +#### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) +#### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) +#### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) +#### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) +#### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) + + + +## [Onboard and configure machines to Windows Defender ATP](onboard.md) +### [Onboard machines - need to revise this page](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) +#### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md) +#### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md) +##### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md) +##### [Onboard machines using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) +##### [Onboard machines using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) +##### [Onboard machines using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md) +##### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) +#### [Onboard servers](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md) +#### [Onboard non-Windows machines](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) +#### [Run a detection test on a newly onboarded machine](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md) +#### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) +#### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) + + + + +###[Configure ASR](configure1.md) +#### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) +#### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) +#### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) + + + + + + +### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) +#### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) +#### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) +##### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) + +#### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) +##### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) +###### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) +##### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) +###### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) +##### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) +###### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) +###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) +###### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) +###### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) +###### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) + +#### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) +##### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md) +###### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) +##### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) +##### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md) +##### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md) +##### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md) +##### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) +##### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) +#### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) +#### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) +##### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) +##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) +##### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) +##### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) +##### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) + + + + + +### [Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) + + + +### [Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) +####General +##### [Update data retention settings](windows-defender-atp\data-retention-settings-windows-defender-advanced-threat-protection.md) +##### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md) +##### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md) +##### [Enable Secure score security controls](windows-defender-atp\enable-secure-score-windows-defender-advanced-threat-protection.md) +##### [Configure advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md) + + + + +####APIs +##### [Enable Threat intel](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md) + +####Rules +##### [Manage suppression rules](windows-defender-atp\manage-suppression-rules-windows-defender-advanced-threat-protection.md) +##### [Manage automation allowed/blocked](windows-defender-atp\manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) +##### [Manage automation file uploads](windows-defender-atp\manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) +##### [Manage automation folder exclusions](windows-defender-atp\manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) + +####Machine management +##### [Onboarding machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) +##### [Offboarding machines](windows-defender-atp\offboard-machines-windows-defender-advanced-threat-protection.md) + +#### [Configure Windows Defender Security Center time zone settings](windows-defender-atp\time-settings-windows-defender-advanced-threat-protection.md) + + + + +## [Windows Defender Security Center](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) +### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) +### [View the Security operations dashboard - consdier moving to the relevant pillar](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) + +### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) + + + + + + + + + + + + + +## [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) +### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) +#### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) +### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) + + +### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) +#### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) + +#### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) +#### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) +##### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) + +### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) + +#### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) +#### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) +### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) + +#### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) +#### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) + + + +#### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) +#### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) +#### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) + +## [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) +### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +#### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) +#### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) +#### [Configure and validate network connections](windows-defender-antivirus\configure-network-connections-windows-defender-antivirus.md) +#### [Enable the Block at First Sight feature](windows-defender-antivirus\configure-block-at-first-sight-windows-defender-antivirus.md) +#### [Configure the cloud block timeout period](windows-defender-antivirus\configure-cloud-block-timeout-period-windows-defender-antivirus.md) +### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus\configure-protection-features-windows-defender-antivirus.md) +#### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus\detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) +#### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md) + + + +## [Endpoint detection and response - Tomer B.](faketopic.md) ###Alerts queue -#### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -#### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) -#### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -#### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) -#### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) -#### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) -#### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) -#### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md) - - - +#### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) +#### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md) +#### [Investigate alerts](windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md) +#### [Investigate files](windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md) +#### [Investigate machines](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md) +#### [Investigate an IP address](windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md) +#### [Investigate a domain](windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md) +#### [Investigate a user account](windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md) ###Machines list -#### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) -#### [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) -#### [Alerts related to this machine](investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) -#### [Machine timeline](investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) -##### [Search for specific events](investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) -##### [Filter events from a specific date](investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) -##### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) -##### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) +#### [View and organize the Machines list](windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md) +#### [Manage machine group and tags](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) +#### [Alerts related to this machine](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) +#### [Machine timeline](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) +##### [Search for specific events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) +##### [Filter events from a specific date](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) +##### [Export machine timeline events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) +##### [Navigate between pages](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) -### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md) -#### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md) -##### [Collect investigation package](respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) -##### [Run antivirus scan](respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) -##### [Restrict app execution](respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) -##### [Remove app restriction](respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) -##### [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) -##### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) -##### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) -#### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md) -##### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) -##### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) -##### [Block files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) -##### [Remove file from blocked list](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) -##### [Check activity details in Action center](respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) -##### [Deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) -###### [Submit files for analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) -###### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) -###### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) +### [Take response actions](windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md) +#### [Take response actions on a machine](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md) +##### [Collect investigation package](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) +##### [Run antivirus scan](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) +##### [Restrict app execution](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) +##### [Remove app restriction](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) +##### [Isolate machines from the network](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) +##### [Release machine from isolation](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) +##### [Check activity details in Action center](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) -### [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md) -#### [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md) -#### [Advanced hunting query language best practices](advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) +#### [Take response actions on a file](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md) +##### [Stop and quarantine files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) +##### [Remove file from quarantine](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) +##### [Block files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) +##### [Remove file from blocked list](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) +##### [Check activity details in Action center](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) +##### [Deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) +##### [Submit files for analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) +##### [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) +##### [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) -## [Use Automated investigation to investigate and remediate threats](automated-investigations-windows-defender-advanced-threat-protection.md) -## [Protect data with conditional access](conditional-access-windows-defender-advanced-threat-protection.md) -##API and SIEM support -### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md) -#### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) -#### [Configure Splunk to pull alerts](configure-splunk-windows-defender-advanced-threat-protection.md) -#### [Configure HP ArcSight to pull alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) -#### [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) -#### [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md) -### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -#### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) -#### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) -#### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) -#### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) -### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) -#### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md) +### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) +#### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) +#### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) + + +## [Automatic investigation and remediation - Benny](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) + + +##Security posture +### [Secure posture - Evald](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) +### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) + + + +## [Management and APIs](management-apis.md) +### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) +#### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) +#### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md) +#### [Configure HP ArcSight to pull alerts](windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md) +#### [Windows Defender ATP alert API fields](windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md) +#### [Pull alerts using REST API](windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md) + +### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md) +#### [Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md) #####Actor -###### [Get actor information](get-actor-information-windows-defender-advanced-threat-protection.md) -###### [Get actor related alerts](get-actor-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get actor information](windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md) +###### [Get actor related alerts](windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md) #####Alerts -###### [Get alerts](get-alerts-windows-defender-advanced-threat-protection.md) -###### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection.md) -###### [Get alert related actor information](get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related domain information](get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related IP information](get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) -#####Domain -###### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection.md) -###### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection.md) -###### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) +###### [Get alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md) +###### [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md) +###### [Get alert related actor information](windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related domain information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related IP information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) +######Domain +####### [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md) +####### [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) #####File -###### [Block file](block-file-windows-defender-advanced-threat-protection.md) -###### [Get file information](get-file-information-windows-defender-advanced-threat-protection.md) -###### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection.md) -###### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection.md) -###### [Get FileActions collection](get-fileactions-collection-windows-defender-advanced-threat-protection.md) -###### [Unblock file](unblock-file-windows-defender-advanced-threat-protection.md) +###### [Block file API](windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md) +###### [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md) +###### [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md) +###### [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md) +###### [Get FileActions collection API](windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md) +###### [Unblock file API](windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md) #####IP -###### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection.md) -###### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection.md) -###### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection.md) +###### [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md) +###### [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md) +###### [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md) #####Machines -###### [Collect investigation package](collect-investigation-package-windows-defender-advanced-threat-protection.md) -###### [Find machine information by IP](find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) -###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) -###### [Get FileMachineAction object](get-filemachineaction-object-windows-defender-advanced-threat-protection.md) -###### [Get FileMachineActions collection](get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) -###### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection.md) -###### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection.md) -###### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get MachineAction object](get-machineaction-object-windows-defender-advanced-threat-protection.md) -###### [Get MachineActions collection](get-machineactions-collection-windows-defender-advanced-threat-protection.md) -###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) -###### [Get package SAS URI](get-package-sas-uri-windows-defender-advanced-threat-protection.md) -###### [Isolate machine](isolate-machine-windows-defender-advanced-threat-protection.md) -###### [Release machine from isolation](unisolate-machine-windows-defender-advanced-threat-protection.md) -###### [Remove app restriction](unrestrict-code-execution-windows-defender-advanced-threat-protection.md) -###### [Request sample](request-sample-windows-defender-advanced-threat-protection.md) -###### [Restrict app execution](restrict-code-execution-windows-defender-advanced-threat-protection.md) -###### [Run antivirus scan](run-av-scan-windows-defender-advanced-threat-protection.md) -###### [Stop and quarantine file](stop-quarantine-file-windows-defender-advanced-threat-protection.md) +###### [Collect investigation package API](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md) +###### [Find machine information by IP](windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) +###### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) +###### [Get FileMachineAction object API](windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md) +###### [Get FileMachineActions collection API](windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) +###### [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md) +###### [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md) +###### [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get MachineAction object API](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md) +###### [Get MachineActions collection API](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md) +###### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) +###### [Get package SAS URI API](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md) +###### [Isolate machine API](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md) +###### [Release machine from isolation API](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md) +###### [Remove app restriction API](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md) +###### [Request sample API](windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md) +###### [Restrict app execution API](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md) +###### [Run antivirus scan API](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md) +###### [Stop and quarantine file API](windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md) #####User -###### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection.md) -###### [Get user information](get-user-information-windows-defender-advanced-threat-protection.md) -###### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection.md) - -##Reporting -### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) - -##Check service health and sensor state -### [Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md) -### [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) -### [Inactive machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) -### [Misconfigured machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) -### [Check service health](service-status-windows-defender-advanced-threat-protection.md) -## [Configure Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md) - -###General -#### [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md) -#### [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md) -#### [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) -#### [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md) -#### [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md) +###### [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md) +###### [Get user information](windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md) +###### [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md) -###Permissions -#### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md) -#### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) -###APIs -#### [Enable Threat intel](enable-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) -###Rules -#### [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md) -#### [Manage automation allowed/blocked](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -#### [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) -#### [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) +### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md) +#### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md) +#### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) +#### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md) +#### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md) +#### [Python code examples](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md) +#### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) -###Machine management -#### [Onboarding machines](onboard-configure-windows-defender-advanced-threat-protection.md) -#### [Offboarding machines](offboard-machines-windows-defender-advanced-threat-protection.md) +### [Reporting](reporting.md) +#### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) -## [Configure Windows Defender Security Center zone settings](time-settings-windows-defender-advanced-threat-protection.md) +### [Permissions](permissions.md) +#### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md) +#### [Create and manage machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md) -## [Access the Windows Defender ATP Community Center](community-windows-defender-advanced-threat-protection.md) -## [Troubleshoot Windows Defender ATP service issues](troubleshoot-windows-defender-advanced-threat-protection.md) -### [Review events and errors on machines with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md) + +## [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](integration.md) +### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) + + + + + + + + + + + + + + + + + + + + + + +##Troubleshoot Windows Defender ATP +### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) + +###Troubleshoot sensor state - Ask Heike name of sensor +#### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) +#### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) +#### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) +#### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) +#### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) + +### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) +#### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) + + + + + + + + + + + + + + + + + + +# Other security features +## [The Windows Security app](windows-defender-security-center/windows-defender-security-center.md) +### [Customize the Windows Security app for your organization](windows-defender-security-center/wdsc-customize-contact-information.md) +### [Hide Windows Security app notifications](windows-defender-security-center/wdsc-hide-notifications.md) +### [Manage Windows Security app in Windows 10 in S mode](windows-defender-security-center\wdsc-windows-10-in-s-mode.md) +### [Virus and threat protection](windows-defender-security-center/wdsc-virus-threat-protection.md) +### [Account protection](windows-defender-security-center\wdsc-account-protection.md) +### [Firewall and network protection](windows-defender-security-center\wdsc-firewall-network-protection.md) +### [App and browser control](windows-defender-security-center\wdsc-app-browser-control.md) +### [Device security](windows-defender-security-center\wdsc-device-security.md) +### [Device performance and health](windows-defender-security-center\wdsc-device-performance-health.md) +### [Family options](windows-defender-security-center\wdsc-family-options.md) + + +## [Windows Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) +### [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) +### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) + + +## [Windows Defender Device Guard: virtualization-based security and WDAC](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) + + +## [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) + +## [Mitigate threats by using Windows 10 security features](overview-of-threat-mitigations-in-windows-10.md) + +## [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) + +## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-intrusion-detection.md) + +## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) + +## [Security auditing](auditing/security-auditing-overview.md) + +### [Basic security audit policies](auditing/basic-security-audit-policies.md) +#### [Create a basic audit policy for an event category](auditing/create-a-basic-audit-policy-settings-for-an-event-category.md) +#### [Apply a basic audit policy on a file or folder](auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md) +#### [View the security event log](auditing/view-the-security-event-log.md) + +#### [Basic security audit policy settings](auditing/basic-security-audit-policy-settings.md) +##### [Audit account logon events](auditing/basic-audit-account-logon-events.md) +##### [Audit account management](auditing/basic-audit-account-management.md) +##### [Audit directory service access](auditing/basic-audit-directory-service-access.md) +##### [Audit logon events](auditing/basic-audit-logon-events.md) +##### [Audit object access](auditing/basic-audit-object-access.md) +##### [Audit policy change](auditing/basic-audit-policy-change.md) +##### [Audit privilege use](auditing/basic-audit-privilege-use.md) +##### [Audit process tracking](auditing/basic-audit-process-tracking.md) +##### [Audit system events](auditing/basic-audit-system-events.md) + +#### [Advanced security audit policies](auditing/advanced-security-auditing.md) +##### [Planning and deploying advanced security audit policies](auditing/planning-and-deploying-advanced-security-audit-policies.md) +##### [Advanced security auditing FAQ](auditing/advanced-security-auditing-faq.md) +###### [Which editions of Windows support advanced audit policy configuration](auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md) + +##### [Using advanced security auditing options to monitor dynamic access control objects](auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) +###### [Monitor the central access policies that apply on a file server](auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md) +###### [Monitor the use of removable storage devices](auditing/monitor-the-use-of-removable-storage-devices.md) +###### [Monitor resource attribute definitions](auditing/monitor-resource-attribute-definitions.md) +###### [Monitor central access policy and rule definitions](auditing/monitor-central-access-policy-and-rule-definitions.md) +###### [Monitor user and device claims during sign-in](auditing/monitor-user-and-device-claims-during-sign-in.md) +###### [Monitor the resource attributes on files and folders](auditing/monitor-the-resource-attributes-on-files-and-folders.md) +###### [Monitor the central access policies associated with files and folders](auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md) +###### [Monitor claim types](auditing/monitor-claim-types.md) + +##### [Advanced security audit policy settings](auditing/advanced-security-audit-policy-settings.md) +###### [Audit Credential Validation](auditing/audit-credential-validation.md) +###### [Event 4774 S, F: An account was mapped for logon.](auditing/event-4774.md) +###### [Event 4775 F: An account could not be mapped for logon.](auditing/event-4775.md) +###### [Event 4776 S, F: The computer attempted to validate the credentials for an account.](auditing/event-4776.md) +###### [Event 4777 F: The domain controller failed to validate the credentials for an account.](auditing/event-4777.md) +##### [Audit Kerberos Authentication Service](auditing/audit-kerberos-authentication-service.md) +###### [Event 4768 S, F: A Kerberos authentication ticket, TGT, was requested.](auditing/event-4768.md) +###### [Event 4771 F: Kerberos pre-authentication failed.](auditing/event-4771.md) +###### [Event 4772 F: A Kerberos authentication ticket request failed.](auditing/event-4772.md) +##### [Audit Kerberos Service Ticket Operations](auditing/audit-kerberos-service-ticket-operations.md) +###### [Event 4769 S, F: A Kerberos service ticket was requested.](auditing/event-4769.md) +###### [Event 4770 S: A Kerberos service ticket was renewed.](auditing/event-4770.md) +###### [Event 4773 F: A Kerberos service ticket request failed.](auditing/event-4773.md) +##### [Audit Other Account Logon Events](auditing/audit-other-account-logon-events.md) +##### [Audit Application Group Management](auditing/audit-application-group-management.md) +##### [Audit Computer Account Management](auditing/audit-computer-account-management.md) +###### [Event 4741 S: A computer account was created.](auditing/event-4741.md) +###### [Event 4742 S: A computer account was changed.](auditing/event-4742.md) +###### [Event 4743 S: A computer account was deleted.](auditing/event-4743.md) +##### [Audit Distribution Group Management](auditing/audit-distribution-group-management.md) +###### [Event 4749 S: A security-disabled global group was created.](auditing/event-4749.md) +###### [Event 4750 S: A security-disabled global group was changed.](auditing/event-4750.md) +###### [Event 4751 S: A member was added to a security-disabled global group.](auditing/event-4751.md) +###### [Event 4752 S: A member was removed from a security-disabled global group.](auditing/event-4752.md) +###### [Event 4753 S: A security-disabled global group was deleted.](auditing/event-4753.md) +##### [Audit Other Account Management Events](auditing/audit-other-account-management-events.md) +###### [Event 4782 S: The password hash an account was accessed.](auditing/event-4782.md) +###### [Event 4793 S: The Password Policy Checking API was called.](auditing/event-4793.md) +##### [Audit Security Group Management](auditing/audit-security-group-management.md) +###### [Event 4731 S: A security-enabled local group was created.](auditing/event-4731.md) +###### [Event 4732 S: A member was added to a security-enabled local group.](auditing/event-4732.md) +###### [Event 4733 S: A member was removed from a security-enabled local group.](auditing/event-4733.md) +###### [Event 4734 S: A security-enabled local group was deleted.](auditing/event-4734.md) +###### [Event 4735 S: A security-enabled local group was changed.](auditing/event-4735.md) +###### [Event 4764 S: A group’s type was changed.](auditing/event-4764.md) +###### [Event 4799 S: A security-enabled local group membership was enumerated.](auditing/event-4799.md) +##### [Audit User Account Management](auditing/audit-user-account-management.md) +###### [Event 4720 S: A user account was created.](auditing/event-4720.md) +###### [Event 4722 S: A user account was enabled.](auditing/event-4722.md) +###### [Event 4723 S, F: An attempt was made to change an account's password.](auditing/event-4723.md) +###### [Event 4724 S, F: An attempt was made to reset an account's password.](auditing/event-4724.md) +###### [Event 4725 S: A user account was disabled.](auditing/event-4725.md) +###### [Event 4726 S: A user account was deleted.](auditing/event-4726.md) +###### [Event 4738 S: A user account was changed.](auditing/event-4738.md) +###### [Event 4740 S: A user account was locked out.](auditing/event-4740.md) +###### [Event 4765 S: SID History was added to an account.](auditing/event-4765.md) +###### [Event 4766 F: An attempt to add SID History to an account failed.](auditing/event-4766.md) +###### [Event 4767 S: A user account was unlocked.](auditing/event-4767.md) +###### [Event 4780 S: The ACL was set on accounts which are members of administrators groups.](auditing/event-4780.md) +###### [Event 4781 S: The name of an account was changed.](auditing/event-4781.md) +###### [Event 4794 S, F: An attempt was made to set the Directory Services Restore Mode administrator password.](auditing/event-4794.md) +###### [Event 4798 S: A user's local group membership was enumerated.](auditing/event-4798.md) +###### [Event 5376 S: Credential Manager credentials were backed up.](auditing/event-5376.md) +###### [Event 5377 S: Credential Manager credentials were restored from a backup.](auditing/event-5377.md) +##### [Audit DPAPI Activity](auditing/audit-dpapi-activity.md) +###### [Event 4692 S, F: Backup of data protection master key was attempted.](auditing/event-4692.md) +###### [Event 4693 S, F: Recovery of data protection master key was attempted.](auditing/event-4693.md) +###### [Event 4694 S, F: Protection of auditable protected data was attempted.](auditing/event-4694.md) +###### [Event 4695 S, F: Unprotection of auditable protected data was attempted.](auditing/event-4695.md) +##### [Audit PNP Activity](auditing/audit-pnp-activity.md) +###### [Event 6416 S: A new external device was recognized by the System.](auditing/event-6416.md) +###### [Event 6419 S: A request was made to disable a device.](auditing/event-6419.md) +###### [Event 6420 S: A device was disabled.](auditing/event-6420.md) +###### [Event 6421 S: A request was made to enable a device.](auditing/event-6421.md) +###### [Event 6422 S: A device was enabled.](auditing/event-6422.md) +###### [Event 6423 S: The installation of this device is forbidden by system policy.](auditing/event-6423.md) +###### [Event 6424 S: The installation of this device was allowed, after having previously been forbidden by policy.](auditing/event-6424.md) +##### [Audit Process Creation](auditing/audit-process-creation.md) +###### [Event 4688 S: A new process has been created.](auditing/event-4688.md) +###### [Event 4696 S: A primary token was assigned to process.](auditing/event-4696.md) +##### [Audit Process Termination](auditing/audit-process-termination.md) +###### [Event 4689 S: A process has exited.](auditing/event-4689.md) +##### [Audit RPC Events](auditing/audit-rpc-events.md) +###### [Event 5712 S: A Remote Procedure Call, RPC, was attempted.](auditing/event-5712.md) +##### [Audit Detailed Directory Service Replication](auditing/audit-detailed-directory-service-replication.md) +###### [Event 4928 S, F: An Active Directory replica source naming context was established.](auditing/event-4928.md) +###### [Event 4929 S, F: An Active Directory replica source naming context was removed.](auditing/event-4929.md) +###### [Event 4930 S, F: An Active Directory replica source naming context was modified.](auditing/event-4930.md) +###### [Event 4931 S, F: An Active Directory replica destination naming context was modified.](auditing/event-4931.md) +###### [Event 4934 S: Attributes of an Active Directory object were replicated.](auditing/event-4934.md) +###### [Event 4935 F: Replication failure begins.](auditing/event-4935.md) +###### [Event 4936 S: Replication failure ends.](auditing/event-4936.md) +###### [Event 4937 S: A lingering object was removed from a replica.](auditing/event-4937.md) +##### [Audit Directory Service Access](auditing/audit-directory-service-access.md) +###### [Event 4662 S, F: An operation was performed on an object.](auditing/event-4662.md) +###### [Event 4661 S, F: A handle to an object was requested.](auditing/event-4661.md) +##### [Audit Directory Service Changes](auditing/audit-directory-service-changes.md) +###### [Event 5136 S: A directory service object was modified.](auditing/event-5136.md) +###### [Event 5137 S: A directory service object was created.](auditing/event-5137.md) +###### [Event 5138 S: A directory service object was undeleted.](auditing/event-5138.md) +###### [Event 5139 S: A directory service object was moved.](auditing/event-5139.md) +###### [Event 5141 S: A directory service object was deleted.](auditing/event-5141.md) +##### [Audit Directory Service Replication](auditing/audit-directory-service-replication.md) +###### [Event 4932 S: Synchronization of a replica of an Active Directory naming context has begun.](auditing/event-4932.md) +###### [Event 4933 S, F: Synchronization of a replica of an Active Directory naming context has ended.](auditing/event-4933.md) +##### [Audit Account Lockout](auditing/audit-account-lockout.md) +###### [Event 4625 F: An account failed to log on.](auditing/event-4625.md) +##### [Audit User/Device Claims](auditing/audit-user-device-claims.md) +###### [Event 4626 S: User/Device claims information.](auditing/event-4626.md) +##### [Audit Group Membership](auditing/audit-group-membership.md) +###### [Event 4627 S: Group membership information.](auditing/event-4627.md) +##### [Audit IPsec Extended Mode](auditing/audit-ipsec-extended-mode.md) +##### [Audit IPsec Main Mode](auditing/audit-ipsec-main-mode.md) +##### [Audit IPsec Quick Mode](auditing/audit-ipsec-quick-mode.md) +##### [Audit Logoff](auditing/audit-logoff.md) +###### [Event 4634 S: An account was logged off.](auditing/event-4634.md) +###### [Event 4647 S: User initiated logoff.](auditing/event-4647.md) +##### [Audit Logon](auditing/audit-logon.md) +###### [Event 4624 S: An account was successfully logged on.](auditing/event-4624.md) +###### [Event 4625 F: An account failed to log on.](auditing/event-4625.md) +###### [Event 4648 S: A logon was attempted using explicit credentials.](auditing/event-4648.md) +###### [Event 4675 S: SIDs were filtered.](auditing/event-4675.md) +##### [Audit Network Policy Server](auditing/audit-network-policy-server.md) +##### [Audit Other Logon/Logoff Events](auditing/audit-other-logonlogoff-events.md) +###### [Event 4649 S: A replay attack was detected.](auditing/event-4649.md) +###### [Event 4778 S: A session was reconnected to a Window Station.](auditing/event-4778.md) +###### [Event 4779 S: A session was disconnected from a Window Station.](auditing/event-4779.md) +###### [Event 4800 S: The workstation was locked.](auditing/event-4800.md) +###### [Event 4801 S: The workstation was unlocked.](auditing/event-4801.md) +###### [Event 4802 S: The screen saver was invoked.](auditing/event-4802.md) +###### [Event 4803 S: The screen saver was dismissed.](auditing/event-4803.md) +###### [Event 5378 F: The requested credentials delegation was disallowed by policy.](auditing/event-5378.md) +###### [Event 5632 S, F: A request was made to authenticate to a wireless network.](auditing/event-5632.md) +###### [Event 5633 S, F: A request was made to authenticate to a wired network.](auditing/event-5633.md) +##### [Audit Special Logon](auditing/audit-special-logon.md) +###### [Event 4964 S: Special groups have been assigned to a new logon.](auditing/event-4964.md) +###### [Event 4672 S: Special privileges assigned to new logon.](auditing/event-4672.md) +##### [Audit Application Generated](auditing/audit-application-generated.md) +##### [Audit Certification Services](auditing/audit-certification-services.md) +##### [Audit Detailed File Share](auditing/audit-detailed-file-share.md) +###### [Event 5145 S, F: A network share object was checked to see whether client can be granted desired access.](auditing/event-5145.md) +##### [Audit File Share](auditing/audit-file-share.md) +###### [Event 5140 S, F: A network share object was accessed.](auditing/event-5140.md) +###### [Event 5142 S: A network share object was added.](auditing/event-5142.md) +###### [Event 5143 S: A network share object was modified.](auditing/event-5143.md) +###### [Event 5144 S: A network share object was deleted.](auditing/event-5144.md) +###### [Event 5168 F: SPN check for SMB/SMB2 failed.](auditing/event-5168.md) +##### [Audit File System](auditing/audit-file-system.md) +###### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) +###### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) +###### [Event 4660 S: An object was deleted.](auditing/event-4660.md) +###### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) +###### [Event 4664 S: An attempt was made to create a hard link.](auditing/event-4664.md) +###### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) +###### [Event 5051: A file was virtualized.](auditing/event-5051.md) +###### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) +##### [Audit Filtering Platform Connection](auditing/audit-filtering-platform-connection.md) +###### [Event 5031 F: The Windows Firewall Service blocked an application from accepting incoming connections on the network.](auditing/event-5031.md) +###### [Event 5150: The Windows Filtering Platform blocked a packet.](auditing/event-5150.md) +###### [Event 5151: A more restrictive Windows Filtering Platform filter has blocked a packet.](auditing/event-5151.md) +###### [Event 5154 S: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.](auditing/event-5154.md) +###### [Event 5155 F: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.](auditing/event-5155.md) +###### [Event 5156 S: The Windows Filtering Platform has permitted a connection.](auditing/event-5156.md) +###### [Event 5157 F: The Windows Filtering Platform has blocked a connection.](auditing/event-5157.md) +###### [Event 5158 S: The Windows Filtering Platform has permitted a bind to a local port.](auditing/event-5158.md) +###### [Event 5159 F: The Windows Filtering Platform has blocked a bind to a local port.](auditing/event-5159.md) +##### [Audit Filtering Platform Packet Drop](auditing/audit-filtering-platform-packet-drop.md) +###### [Event 5152 F: The Windows Filtering Platform blocked a packet.](auditing/event-5152.md) +###### [Event 5153 S: A more restrictive Windows Filtering Platform filter has blocked a packet.](auditing/event-5153.md) +##### [Audit Handle Manipulation](auditing/audit-handle-manipulation.md) +###### [Event 4690 S: An attempt was made to duplicate a handle to an object.](auditing/event-4690.md) +##### [Audit Kernel Object](auditing/audit-kernel-object.md) +###### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) +###### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) +###### [Event 4660 S: An object was deleted.](auditing/event-4660.md) +###### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) +##### [Audit Other Object Access Events](auditing/audit-other-object-access-events.md) +###### [Event 4671: An application attempted to access a blocked ordinal through the TBS.](auditing/event-4671.md) +###### [Event 4691 S: Indirect access to an object was requested.](auditing/event-4691.md) +###### [Event 5148 F: The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.](auditing/event-5148.md) +###### [Event 5149 F: The DoS attack has subsided and normal processing is being resumed.](auditing/event-5149.md) +###### [Event 4698 S: A scheduled task was created.](auditing/event-4698.md) +###### [Event 4699 S: A scheduled task was deleted.](auditing/event-4699.md) +###### [Event 4700 S: A scheduled task was enabled.](auditing/event-4700.md) +###### [Event 4701 S: A scheduled task was disabled.](auditing/event-4701.md) +###### [Event 4702 S: A scheduled task was updated.](auditing/event-4702.md) +###### [Event 5888 S: An object in the COM+ Catalog was modified.](auditing/event-5888.md) +###### [Event 5889 S: An object was deleted from the COM+ Catalog.](auditing/event-5889.md) +###### [Event 5890 S: An object was added to the COM+ Catalog.](auditing/event-5890.md) +##### [Audit Registry](auditing/audit-registry.md) +###### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) +###### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) +###### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) +###### [Event 4660 S: An object was deleted.](auditing/event-4660.md) +###### [Event 4657 S: A registry value was modified.](auditing/event-4657.md) +###### [Event 5039: A registry key was virtualized.](auditing/event-5039.md) +###### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) +##### [Audit Removable Storage](auditing/audit-removable-storage.md) +##### [Audit SAM](auditing/audit-sam.md) +###### [Event 4661 S, F: A handle to an object was requested.](auditing/event-4661.md) +##### [Audit Central Access Policy Staging](auditing/audit-central-access-policy-staging.md) +###### [Event 4818 S: Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy.](auditing/event-4818.md) +##### [Audit Audit Policy Change](auditing/audit-audit-policy-change.md) +###### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) +###### [Event 4715 S: The audit policy, SACL, on an object was changed.](auditing/event-4715.md) +###### [Event 4719 S: System audit policy was changed.](auditing/event-4719.md) +###### [Event 4817 S: Auditing settings on object were changed.](auditing/event-4817.md) +###### [Event 4902 S: The Per-user audit policy table was created.](auditing/event-4902.md) +###### [Event 4906 S: The CrashOnAuditFail value has changed.](auditing/event-4906.md) +###### [Event 4907 S: Auditing settings on object were changed.](auditing/event-4907.md) +###### [Event 4908 S: Special Groups Logon table modified.](auditing/event-4908.md) +###### [Event 4912 S: Per User Audit Policy was changed.](auditing/event-4912.md) +###### [Event 4904 S: An attempt was made to register a security event source.](auditing/event-4904.md) +###### [Event 4905 S: An attempt was made to unregister a security event source.](auditing/event-4905.md) +##### [Audit Authentication Policy Change](auditing/audit-authentication-policy-change.md) +###### [Event 4706 S: A new trust was created to a domain.](auditing/event-4706.md) +###### [Event 4707 S: A trust to a domain was removed.](auditing/event-4707.md) +###### [Event 4716 S: Trusted domain information was modified.](auditing/event-4716.md) +###### [Event 4713 S: Kerberos policy was changed.](auditing/event-4713.md) +###### [Event 4717 S: System security access was granted to an account.](auditing/event-4717.md) +###### [Event 4718 S: System security access was removed from an account.](auditing/event-4718.md) +###### [Event 4739 S: Domain Policy was changed.](auditing/event-4739.md) +###### [Event 4864 S: A namespace collision was detected.](auditing/event-4864.md) +###### [Event 4865 S: A trusted forest information entry was added.](auditing/event-4865.md) +###### [Event 4866 S: A trusted forest information entry was removed.](auditing/event-4866.md) +###### [Event 4867 S: A trusted forest information entry was modified.](auditing/event-4867.md) +##### [Audit Authorization Policy Change](auditing/audit-authorization-policy-change.md) +###### [Event 4703 S: A user right was adjusted.](auditing/event-4703.md) +###### [Event 4704 S: A user right was assigned.](auditing/event-4704.md) +###### [Event 4705 S: A user right was removed.](auditing/event-4705.md) +###### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) +###### [Event 4911 S: Resource attributes of the object were changed.](auditing/event-4911.md) +###### [Event 4913 S: Central Access Policy on the object was changed.](auditing/event-4913.md) +##### [Audit Filtering Platform Policy Change](auditing/audit-filtering-platform-policy-change.md) +##### [Audit MPSSVC Rule-Level Policy Change](auditing/audit-mpssvc-rule-level-policy-change.md) +###### [Event 4944 S: The following policy was active when the Windows Firewall started.](auditing/event-4944.md) +###### [Event 4945 S: A rule was listed when the Windows Firewall started.](auditing/event-4945.md) +###### [Event 4946 S: A change has been made to Windows Firewall exception list. A rule was added.](auditing/event-4946.md) +###### [Event 4947 S: A change has been made to Windows Firewall exception list. A rule was modified.](auditing/event-4947.md) +###### [Event 4948 S: A change has been made to Windows Firewall exception list. A rule was deleted.](auditing/event-4948.md) +###### [Event 4949 S: Windows Firewall settings were restored to the default values.](auditing/event-4949.md) +###### [Event 4950 S: A Windows Firewall setting has changed.](auditing/event-4950.md) +###### [Event 4951 F: A rule has been ignored because its major version number was not recognized by Windows Firewall.](auditing/event-4951.md) +###### [Event 4952 F: Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.](auditing/event-4952.md) +###### [Event 4953 F: Windows Firewall ignored a rule because it could not be parsed.](auditing/event-4953.md) +###### [Event 4954 S: Windows Firewall Group Policy settings have changed. The new settings have been applied.](auditing/event-4954.md) +###### [Event 4956 S: Windows Firewall has changed the active profile.](auditing/event-4956.md) +###### [Event 4957 F: Windows Firewall did not apply the following rule.](auditing/event-4957.md) +###### [Event 4958 F: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.](auditing/event-4958.md) +##### [Audit Other Policy Change Events](auditing/audit-other-policy-change-events.md) +###### [Event 4714 S: Encrypted data recovery policy was changed.](auditing/event-4714.md) +###### [Event 4819 S: Central Access Policies on the machine have been changed.](auditing/event-4819.md) +###### [Event 4826 S: Boot Configuration Data loaded.](auditing/event-4826.md) +###### [Event 4909: The local policy settings for the TBS were changed.](auditing/event-4909.md) +###### [Event 4910: The group policy settings for the TBS were changed.](auditing/event-4910.md) +###### [Event 5063 S, F: A cryptographic provider operation was attempted.](auditing/event-5063.md) +###### [Event 5064 S, F: A cryptographic context operation was attempted.](auditing/event-5064.md) +###### [Event 5065 S, F: A cryptographic context modification was attempted.](auditing/event-5065.md) +###### [Event 5066 S, F: A cryptographic function operation was attempted.](auditing/event-5066.md) +###### [Event 5067 S, F: A cryptographic function modification was attempted.](auditing/event-5067.md) +###### [Event 5068 S, F: A cryptographic function provider operation was attempted.](auditing/event-5068.md) +###### [Event 5069 S, F: A cryptographic function property operation was attempted.](auditing/event-5069.md) +###### [Event 5070 S, F: A cryptographic function property modification was attempted.](auditing/event-5070.md) +###### [Event 5447 S: A Windows Filtering Platform filter has been changed.](auditing/event-5447.md) +###### [Event 6144 S: Security policy in the group policy objects has been applied successfully.](auditing/event-6144.md) +###### [Event 6145 F: One or more errors occurred while processing security policy in the group policy objects.](auditing/event-6145.md) +##### [Audit Sensitive Privilege Use](auditing/audit-sensitive-privilege-use.md) +###### [Event 4673 S, F: A privileged service was called.](auditing/event-4673.md) +###### [Event 4674 S, F: An operation was attempted on a privileged object.](auditing/event-4674.md) +###### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) +##### [Audit Non Sensitive Privilege Use](auditing/audit-non-sensitive-privilege-use.md) +###### [Event 4673 S, F: A privileged service was called.](auditing/event-4673.md) +###### [Event 4674 S, F: An operation was attempted on a privileged object.](auditing/event-4674.md) +###### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) +##### [Audit Other Privilege Use Events](auditing/audit-other-privilege-use-events.md) +###### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) +##### [Audit IPsec Driver](auditing/audit-ipsec-driver.md) +##### [Audit Other System Events](auditing/audit-other-system-events.md) +###### [Event 5024 S: The Windows Firewall Service has started successfully.](auditing/event-5024.md) +###### [Event 5025 S: The Windows Firewall Service has been stopped.](auditing/event-5025.md) +###### [Event 5027 F: The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.](auditing/event-5027.md) +###### [Event 5028 F: The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.](auditing/event-5028.md) +###### [Event 5029 F: The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.](auditing/event-5029.md) +###### [Event 5030 F: The Windows Firewall Service failed to start.](auditing/event-5030.md) +###### [Event 5032 F: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.](auditing/event-5032.md) +###### [Event 5033 S: The Windows Firewall Driver has started successfully.](auditing/event-5033.md) +###### [Event 5034 S: The Windows Firewall Driver was stopped.](auditing/event-5034.md) +###### [Event 5035 F: The Windows Firewall Driver failed to start.](auditing/event-5035.md) +###### [Event 5037 F: The Windows Firewall Driver detected critical runtime error. Terminating.](auditing/event-5037.md) +###### [Event 5058 S, F: Key file operation.](auditing/event-5058.md) +###### [Event 5059 S, F: Key migration operation.](auditing/event-5059.md) +###### [Event 6400: BranchCache: Received an incorrectly formatted response while discovering availability of content.](auditing/event-6400.md) +###### [Event 6401: BranchCache: Received invalid data from a peer. Data discarded.](auditing/event-6401.md) +###### [Event 6402: BranchCache: The message to the hosted cache offering it data is incorrectly formatted.](auditing/event-6402.md) +###### [Event 6403: BranchCache: The hosted cache sent an incorrectly formatted response to the client.](auditing/event-6403.md) +###### [Event 6404: BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.](auditing/event-6404.md) +###### [Event 6405: BranchCache: %2 instances of event id %1 occurred.](auditing/event-6405.md) +###### [Event 6406: %1 registered to Windows Firewall to control filtering for the following: %2.](auditing/event-6406.md) +###### [Event 6407: 1%.](auditing/event-6407.md) +###### [Event 6408: Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.](auditing/event-6408.md) +###### [Event 6409: BranchCache: A service connection point object could not be parsed.](auditing/event-6409.md) +##### [Audit Security State Change](auditing/audit-security-state-change.md) +###### [Event 4608 S: Windows is starting up.](auditing/event-4608.md) +###### [Event 4616 S: The system time was changed.](auditing/event-4616.md) +###### [Event 4621 S: Administrator recovered system from CrashOnAuditFail.](auditing/event-4621.md) +##### [Audit Security System Extension](auditing/audit-security-system-extension.md) +###### [Event 4610 S: An authentication package has been loaded by the Local Security Authority.](auditing/event-4610.md) +###### [Event 4611 S: A trusted logon process has been registered with the Local Security Authority.](auditing/event-4611.md) +###### [Event 4614 S: A notification package has been loaded by the Security Account Manager.](auditing/event-4614.md) +###### [Event 4622 S: A security package has been loaded by the Local Security Authority.](auditing/event-4622.md) +###### [Event 4697 S: A service was installed in the system.](auditing/event-4697.md) +##### [Audit System Integrity](auditing/audit-system-integrity.md) +###### [Event 4612 S: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.](auditing/event-4612.md) +###### [Event 4615 S: Invalid use of LPC port.](auditing/event-4615.md) +###### [Event 4618 S: A monitored security event pattern has occurred.](auditing/event-4618.md) +###### [Event 4816 S: RPC detected an integrity violation while decrypting an incoming message.](auditing/event-4816.md) +###### [Event 5038 F: Code integrity determined that the image hash of a file is not valid.](auditing/event-5038.md) +###### [Event 5056 S: A cryptographic self-test was performed.](auditing/event-5056.md) +###### [Event 5062 S: A kernel-mode cryptographic self-test was performed.](auditing/event-5062.md) +###### [Event 5057 F: A cryptographic primitive operation failed.](auditing/event-5057.md) +###### [Event 5060 F: Verification operation failed.](auditing/event-5060.md) +###### [Event 5061 S, F: Cryptographic operation.](auditing/event-5061.md) +###### [Event 6281 F: Code Integrity determined that the page hashes of an image file are not valid.](auditing/event-6281.md) +###### [Event 6410 F: Code integrity determined that a file does not meet the security requirements to load into a process.](auditing/event-6410.md) +##### [Other Events](auditing/other-events.md) +###### [Event 1100 S: The event logging service has shut down.](auditing/event-1100.md) +###### [Event 1102 S: The audit log was cleared.](auditing/event-1102.md) +###### [Event 1104 S: The security log is now full.](auditing/event-1104.md) +###### [Event 1105 S: Event log automatic backup.](auditing/event-1105.md) +###### [Event 1108 S: The event logging service encountered an error while processing an incoming event published from %1.](auditing/event-1108.md) +##### [Appendix A: Security monitoring recommendations for many audit events](auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md) +##### [Registry (Global Object Access Auditing) ](auditing/registry-global-object-access-auditing.md) +##### [File System (Global Object Access Auditing) ](auditing/file-system-global-object-access-auditing.md) + + + + + +### [Security policy settings](security-policy-settings/security-policy-settings.md) +### [Administer security policy settings](security-policy-settings/administer-security-policy-settings.md) +#### [Network List Manager policies](security-policy-settings/network-list-manager-policies.md) +### [Configure security policy settings](security-policy-settings/how-to-configure-security-policy-settings.md) +### [Security policy settings reference](security-policy-settings/security-policy-settings-reference.md) +#### [Account Policies](security-policy-settings/account-policies.md) +##### [Password Policy](security-policy-settings/password-policy.md) +###### [Enforce password history](security-policy-settings/enforce-password-history.md) +###### [Maximum password age](security-policy-settings/maximum-password-age.md) +###### [Minimum password age](security-policy-settings/minimum-password-age.md) +###### [Minimum password length](security-policy-settings/minimum-password-length.md) +###### [Password must meet complexity requirements](security-policy-settings/password-must-meet-complexity-requirements.md) +###### [Store passwords using reversible encryption](security-policy-settings/store-passwords-using-reversible-encryption.md) +##### [Account Lockout Policy](security-policy-settings/account-lockout-policy.md) +###### [Account lockout duration](security-policy-settings/account-lockout-duration.md) +###### [Account lockout threshold](security-policy-settings/account-lockout-threshold.md) +###### [Reset account lockout counter after](security-policy-settings/reset-account-lockout-counter-after.md) +##### [Kerberos Policy](security-policy-settings/kerberos-policy.md) +###### [Enforce user logon restrictions](security-policy-settings/enforce-user-logon-restrictions.md) +###### [Maximum lifetime for service ticket](security-policy-settings/maximum-lifetime-for-service-ticket.md) +###### [Maximum lifetime for user ticket](security-policy-settings/maximum-lifetime-for-user-ticket.md) +###### [Maximum lifetime for user ticket renewal](security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md) +###### [Maximum tolerance for computer clock synchronization](security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md) +#### [Audit Policy](security-policy-settings/audit-policy.md) +#### [Security Options](security-policy-settings/security-options.md) +##### [Accounts: Administrator account status](security-policy-settings/accounts-administrator-account-status.md) +##### [Accounts: Block Microsoft accounts](security-policy-settings/accounts-block-microsoft-accounts.md) +##### [Accounts: Guest account status](security-policy-settings/accounts-guest-account-status.md) +##### [Accounts: Limit local account use of blank passwords to console logon only](security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md) +##### [Accounts: Rename administrator account](security-policy-settings/accounts-rename-administrator-account.md) +##### [Accounts: Rename guest account](security-policy-settings/accounts-rename-guest-account.md) +##### [Audit: Audit the access of global system objects](security-policy-settings/audit-audit-the-access-of-global-system-objects.md) +##### [Audit: Audit the use of Backup and Restore privilege](security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md) +##### [Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings](security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md) +##### [Audit: Shut down system immediately if unable to log security audits](security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md) +##### [DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax](security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md) +##### [DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax](security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md) +##### [Devices: Allow undock without having to log on](security-policy-settings/devices-allow-undock-without-having-to-log-on.md) +##### [Devices: Allowed to format and eject removable media](security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md) +##### [Devices: Prevent users from installing printer drivers](security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md) +##### [Devices: Restrict CD-ROM access to locally logged-on user only](security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md) +##### [Devices: Restrict floppy access to locally logged-on user only](security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md) +##### [Domain controller: Allow server operators to schedule tasks](security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md) +##### [Domain controller: LDAP server signing requirements](security-policy-settings/domain-controller-ldap-server-signing-requirements.md) +##### [Domain controller: Refuse machine account password changes](security-policy-settings/domain-controller-refuse-machine-account-password-changes.md) +##### [Domain member: Digitally encrypt or sign secure channel data (always)](security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) +##### [Domain member: Digitally encrypt secure channel data (when possible)](security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md) +##### [Domain member: Digitally sign secure channel data (when possible)](security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md) +##### [Domain member: Disable machine account password changes](security-policy-settings/domain-member-disable-machine-account-password-changes.md) +##### [Domain member: Maximum machine account password age](security-policy-settings/domain-member-maximum-machine-account-password-age.md) +##### [Domain member: Require strong (Windows 2000 or later) session key](security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md) +##### [Interactive logon: Display user information when the session is locked](security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md) +##### [Interactive logon: Don't display last signed-in](security-policy-settings/interactive-logon-do-not-display-last-user-name.md) +##### [Interactive logon: Don't display username at sign-in](security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md) +##### [Interactive logon: Do not require CTRL+ALT+DEL](security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md) +##### [Interactive logon: Machine account lockout threshold](security-policy-settings/interactive-logon-machine-account-lockout-threshold.md) +##### [Interactive logon: Machine inactivity limit](security-policy-settings/interactive-logon-machine-inactivity-limit.md) +##### [Interactive logon: Message text for users attempting to log on](security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md) +##### [Interactive logon: Message title for users attempting to log on](security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md) +##### [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) +##### [Interactive logon: Prompt user to change password before expiration](security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md) +##### [Interactive logon: Require Domain Controller authentication to unlock workstation](security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md) +##### [Interactive logon: Require smart card](security-policy-settings/interactive-logon-require-smart-card.md) +##### [Interactive logon: Smart card removal behavior](security-policy-settings/interactive-logon-smart-card-removal-behavior.md) +##### [Microsoft network client: Digitally sign communications (always)](security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md) +##### [SMBv1 Microsoft network client: Digitally sign communications (always)](security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-always.md) +##### [SMBv1 Microsoft network client: Digitally sign communications (if server agrees)](security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees.md) +##### [Microsoft network client: Send unencrypted password to third-party SMB servers](security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md) +##### [Microsoft network server: Amount of idle time required before suspending session](security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md) +##### [Microsoft network server: Attempt S4U2Self to obtain claim information](security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md) +##### [Microsoft network server: Digitally sign communications (always)](security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md) +##### [SMBv1 Microsoft network server: Digitally sign communications (always)](security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md) +##### [SMBv1 Microsoft network server: Digitally sign communications (if client agrees)](security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md) +##### [Microsoft network server: Disconnect clients when logon hours expire](security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md) +##### [Microsoft network server: Server SPN target name validation level](security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md) +##### [Network access: Allow anonymous SID/Name translation](security-policy-settings/network-access-allow-anonymous-sidname-translation.md) +##### [Network access: Do not allow anonymous enumeration of SAM accounts](security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md) +##### [Network access: Do not allow anonymous enumeration of SAM accounts and shares](security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md) +##### [Network access: Do not allow storage of passwords and credentials for network authentication](security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md) +##### [Network access: Let Everyone permissions apply to anonymous users](security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md) +##### [Network access: Named Pipes that can be accessed anonymously](security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md) +##### [Network access: Remotely accessible registry paths](security-policy-settings/network-access-remotely-accessible-registry-paths.md) +##### [Network access: Remotely accessible registry paths and subpaths](security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md) +##### [Network access: Restrict anonymous access to Named Pipes and Shares](security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md) +##### [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md) +##### [Network access: Shares that can be accessed anonymously](security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md) +##### [Network access: Sharing and security model for local accounts](security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md) +##### [Network security: Allow Local System to use computer identity for NTLM](security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) +##### [Network security: Allow LocalSystem NULL session fallback](security-policy-settings/network-security-allow-localsystem-null-session-fallback.md) +##### [Network security: Allow PKU2U authentication requests to this computer to use online identities](security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md) +##### [Network security: Configure encryption types allowed for Kerberos Win7 only](security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md) +##### [Network security: Do not store LAN Manager hash value on next password change](security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md) +##### [Network security: Force logoff when logon hours expire](security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md) +##### [Network security: LAN Manager authentication level](security-policy-settings/network-security-lan-manager-authentication-level.md) +##### [Network security: LDAP client signing requirements](security-policy-settings/network-security-ldap-client-signing-requirements.md) +##### [Network security: Minimum session security for NTLM SSP based (including secure RPC) clients](security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md) +##### [Network security: Minimum session security for NTLM SSP based (including secure RPC) servers](security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md) +##### [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md) +##### [Network security: Restrict NTLM: Add server exceptions in this domain](security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md) +##### [Network security: Restrict NTLM: Audit incoming NTLM traffic](security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md) +##### [Network security: Restrict NTLM: Audit NTLM authentication in this domain](security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md) +##### [Network security: Restrict NTLM: Incoming NTLM traffic](security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md) +##### [Network security: Restrict NTLM: NTLM authentication in this domain](security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md) +##### [Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) +##### [Recovery console: Allow automatic administrative logon](security-policy-settings/recovery-console-allow-automatic-administrative-logon.md) +##### [Recovery console: Allow floppy copy and access to all drives and folders](security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md) +##### [Shutdown: Allow system to be shut down without having to log on](security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md) +##### [Shutdown: Clear virtual memory pagefile](security-policy-settings/shutdown-clear-virtual-memory-pagefile.md) +##### [System cryptography: Force strong key protection for user keys stored on the computer](security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md) +##### [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md) +##### [System objects: Require case insensitivity for non-Windows subsystems](security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md) +##### [System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)](security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md) +##### [System settings: Optional subsystems](security-policy-settings/system-settings-optional-subsystems.md) +##### [System settings: Use certificate rules on Windows executables for Software Restriction Policies](security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md) +##### [User Account Control: Admin Approval Mode for the Built-in Administrator account](security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md) +##### [User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop](security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md) +##### [User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode](security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md) +##### [User Account Control: Behavior of the elevation prompt for standard users](security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md) +##### [User Account Control: Detect application installations and prompt for elevation](security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md) +##### [User Account Control: Only elevate executables that are signed and validated](security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md) +##### [User Account Control: Only elevate UIAccess applications that are installed in secure locations](security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md) +##### [User Account Control: Run all administrators in Admin Approval Mode](security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md) +##### [User Account Control: Switch to the secure desktop when prompting for elevation](security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md) +##### [User Account Control: Virtualize file and registry write failures to per-user locations](security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md) +#### [Advanced security audit policy settings](security-policy-settings/secpol-advanced-security-audit-policy-settings.md) +#### [User Rights Assignment](security-policy-settings/user-rights-assignment.md) +##### [Access Credential Manager as a trusted caller](security-policy-settings/access-credential-manager-as-a-trusted-caller.md) +##### [Access this computer from the network](security-policy-settings/access-this-computer-from-the-network.md) +##### [Act as part of the operating system](security-policy-settings/act-as-part-of-the-operating-system.md) +##### [Add workstations to domain](security-policy-settings/add-workstations-to-domain.md) +##### [Adjust memory quotas for a process](security-policy-settings/adjust-memory-quotas-for-a-process.md) +##### [Allow log on locally](security-policy-settings/allow-log-on-locally.md) +##### [Allow log on through Remote Desktop Services](security-policy-settings/allow-log-on-through-remote-desktop-services.md) +##### [Back up files and directories](security-policy-settings/back-up-files-and-directories.md) +##### [Bypass traverse checking](security-policy-settings/bypass-traverse-checking.md) +##### [Change the system time](security-policy-settings/change-the-system-time.md) +##### [Change the time zone](security-policy-settings/change-the-time-zone.md) +##### [Create a pagefile](security-policy-settings/create-a-pagefile.md) +##### [Create a token object](security-policy-settings/create-a-token-object.md) +##### [Create global objects](security-policy-settings/create-global-objects.md) +##### [Create permanent shared objects](security-policy-settings/create-permanent-shared-objects.md) +##### [Create symbolic links](security-policy-settings/create-symbolic-links.md) +##### [Debug programs](security-policy-settings/debug-programs.md) +##### [Deny access to this computer from the network](security-policy-settings/deny-access-to-this-computer-from-the-network.md) +##### [Deny log on as a batch job](security-policy-settings/deny-log-on-as-a-batch-job.md) +##### [Deny log on as a service](security-policy-settings/deny-log-on-as-a-service.md) +##### [Deny log on locally](security-policy-settings/deny-log-on-locally.md) +##### [Deny log on through Remote Desktop Services](security-policy-settings/deny-log-on-through-remote-desktop-services.md) +##### [Enable computer and user accounts to be trusted for delegation](security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md) +##### [Force shutdown from a remote system](security-policy-settings/force-shutdown-from-a-remote-system.md) +##### [Generate security audits](security-policy-settings/generate-security-audits.md) +##### [Impersonate a client after authentication](security-policy-settings/impersonate-a-client-after-authentication.md) +##### [Increase a process working set](security-policy-settings/increase-a-process-working-set.md) +##### [Increase scheduling priority](security-policy-settings/increase-scheduling-priority.md) +##### [Load and unload device drivers](security-policy-settings/load-and-unload-device-drivers.md) +##### [Lock pages in memory](security-policy-settings/lock-pages-in-memory.md) +##### [Log on as a batch job](security-policy-settings/log-on-as-a-batch-job.md) +##### [Log on as a service](security-policy-settings/log-on-as-a-service.md) +##### [Manage auditing and security log](security-policy-settings/manage-auditing-and-security-log.md) +##### [Modify an object label](security-policy-settings/modify-an-object-label.md) +##### [Modify firmware environment values](security-policy-settings/modify-firmware-environment-values.md) +##### [Perform volume maintenance tasks](security-policy-settings/perform-volume-maintenance-tasks.md) +##### [Profile single process](security-policy-settings/profile-single-process.md) +##### [Profile system performance](security-policy-settings/profile-system-performance.md) +##### [Remove computer from docking station](security-policy-settings/remove-computer-from-docking-station.md) +##### [Replace a process level token](security-policy-settings/replace-a-process-level-token.md) +##### [Restore files and directories](security-policy-settings/restore-files-and-directories.md) +##### [Shut down the system](security-policy-settings/shut-down-the-system.md) +##### [Synchronize directory service data](security-policy-settings/synchronize-directory-service-data.md) +##### [Take ownership of files or other objects](security-policy-settings/take-ownership-of-files-or-other-objects.md) + + + + + + +## [Windows security baselines](windows-security-baselines.md) +## [Security Compliance Toolkit](security-compliance-toolkit-10.md) +## [Get support](get-support-for-security-baselines.md) + +## [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) + +## [Change history for Threat protection](change-history-for-threat-protection.md) From 85dc378a32dbcca9e2ead9769e16d36ed73a530a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 14:48:11 +0300 Subject: [PATCH 015/286] fix toc --- .../windows-defender-atp/TOC.md | 824 +++--------------- 1 file changed, 110 insertions(+), 714 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 7122f7a162..eb61137c27 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -1,14 +1,14 @@ -# [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) +# [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) ## [Get started](fake2.md) -### [Minimum requirements](windows-defender-atp\minimum-requirements-windows-defender-advanced-threat-protection.md) -### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md) -### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) -### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md) -### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) -### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) +### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) +### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) +### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) +### [Preview features](preview-windows-defender-advanced-threat-protection.md) +### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) +### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) -### [Evaluate Windows Defender ATP](evaluate.md) +### [Evaluate Windows Defender ATP](threat-protection\evaluate.md) #### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) #### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) #### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) @@ -40,7 +40,7 @@ -###[Configure ASR](configure1.md) +###[Configure Attack surface reduction](configure1.md) #### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) #### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) #### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) @@ -90,7 +90,7 @@ -### [Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) +### [Configure Automatic investigation and remediation - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) @@ -132,16 +132,6 @@ - - - - - - - - - - ## [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) ### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) #### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) @@ -185,46 +175,46 @@ ## [Endpoint detection and response - Tomer B.](faketopic.md) ###Alerts queue -#### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) -#### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md) -#### [Investigate alerts](windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md) -#### [Investigate files](windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md) -#### [Investigate machines](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md) -#### [Investigate an IP address](windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md) -#### [Investigate a domain](windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md) -#### [Investigate a user account](windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md) +#### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +#### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) +#### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +#### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +#### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) +#### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +#### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) +#### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md) ###Machines list -#### [View and organize the Machines list](windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md) -#### [Manage machine group and tags](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) -#### [Alerts related to this machine](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) -#### [Machine timeline](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) -##### [Search for specific events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) -##### [Filter events from a specific date](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) -##### [Export machine timeline events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) -##### [Navigate between pages](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) +#### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +#### [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) +#### [Alerts related to this machine](investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) +#### [Machine timeline](investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) +##### [Search for specific events](investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) +##### [Filter events from a specific date](investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) +##### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) +##### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) -### [Take response actions](windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md) -#### [Take response actions on a machine](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md) -##### [Collect investigation package](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) -##### [Run antivirus scan](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) -##### [Restrict app execution](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) -##### [Remove app restriction](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) -##### [Isolate machines from the network](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) -##### [Release machine from isolation](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) -##### [Check activity details in Action center](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) +### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md) +#### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md) +##### [Collect investigation package](respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) +##### [Run antivirus scan](respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) +##### [Restrict app execution](respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) +##### [Remove app restriction](respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) +##### [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) +##### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) +##### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) -#### [Take response actions on a file](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md) -##### [Stop and quarantine files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) -##### [Remove file from quarantine](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) -##### [Block files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) -##### [Remove file from blocked list](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) -##### [Check activity details in Action center](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) -##### [Deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) -##### [Submit files for analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) -##### [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) -##### [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) +#### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md) +##### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) +##### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) +##### [Block files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) +##### [Remove file from blocked list](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) +##### [Check activity details in Action center](respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) +##### [Deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) +##### [Submit files for analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) +##### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) +##### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) @@ -243,90 +233,90 @@ ## [Management and APIs](management-apis.md) -### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) -#### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) -#### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md) -#### [Configure HP ArcSight to pull alerts](windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md) -#### [Windows Defender ATP alert API fields](windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md) -#### [Pull alerts using REST API](windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md) +### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md) +#### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) +#### [Configure Splunk to pull alerts](configure-splunk-windows-defender-advanced-threat-protection.md) +#### [Configure HP ArcSight to pull alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) +#### [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) +#### [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md) -### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md) -#### [Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md) +### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) +#### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md) #####Actor -###### [Get actor information](windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md) -###### [Get actor related alerts](windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get actor information](get-actor-information-windows-defender-advanced-threat-protection.md) +###### [Get actor related alerts](get-actor-related-alerts-windows-defender-advanced-threat-protection.md) #####Alerts -###### [Get alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md) -###### [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md) -###### [Get alert related actor information](windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related domain information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related IP information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) +###### [Get alerts](get-alerts-windows-defender-advanced-threat-protection.md) +###### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection.md) +###### [Get alert related actor information](get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related domain information](get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related IP information](get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) ######Domain -####### [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md) -####### [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md) -####### [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md) -####### [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) +####### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection.md) +####### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) #####File -###### [Block file API](windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md) -###### [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md) -###### [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md) -###### [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md) -###### [Get FileActions collection API](windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md) -###### [Unblock file API](windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md) +###### [Block file API](block-file-windows-defender-advanced-threat-protection.md) +###### [Get file information](get-file-information-windows-defender-advanced-threat-protection.md) +###### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection.md) +###### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection.md) +###### [Get FileActions collection API](get-fileactions-collection-windows-defender-advanced-threat-protection.md) +###### [Unblock file API](unblock-file-windows-defender-advanced-threat-protection.md) #####IP -###### [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md) -###### [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md) -###### [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md) +###### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection.md) +###### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection.md) +###### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection.md) #####Machines -###### [Collect investigation package API](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md) -###### [Find machine information by IP](windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) -###### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) -###### [Get FileMachineAction object API](windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md) -###### [Get FileMachineActions collection API](windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) -###### [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md) -###### [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md) -###### [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get MachineAction object API](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md) -###### [Get MachineActions collection API](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md) -###### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) -###### [Get package SAS URI API](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md) -###### [Isolate machine API](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md) -###### [Release machine from isolation API](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md) -###### [Remove app restriction API](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md) -###### [Request sample API](windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md) -###### [Restrict app execution API](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md) -###### [Run antivirus scan API](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md) -###### [Stop and quarantine file API](windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md) +###### [Collect investigation package API](collect-investigation-package-windows-defender-advanced-threat-protection.md) +###### [Find machine information by IP](find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) +###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) +###### [Get FileMachineAction object API](get-filemachineaction-object-windows-defender-advanced-threat-protection.md) +###### [Get FileMachineActions collection API](get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) +###### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection.md) +###### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection.md) +###### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get MachineAction object API](get-machineaction-object-windows-defender-advanced-threat-protection.md) +###### [Get MachineActions collection API](get-machineactions-collection-windows-defender-advanced-threat-protection.md) +###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) +###### [Get package SAS URI API](get-package-sas-uri-windows-defender-advanced-threat-protection.md) +###### [Isolate machine API](isolate-machine-windows-defender-advanced-threat-protection.md) +###### [Release machine from isolation API](unisolate-machine-windows-defender-advanced-threat-protection.md) +###### [Remove app restriction API](unrestrict-code-execution-windows-defender-advanced-threat-protection.md) +###### [Request sample API](request-sample-windows-defender-advanced-threat-protection.md) +###### [Restrict app execution API](restrict-code-execution-windows-defender-advanced-threat-protection.md) +###### [Run antivirus scan API](run-av-scan-windows-defender-advanced-threat-protection.md) +###### [Stop and quarantine file API](stop-quarantine-file-windows-defender-advanced-threat-protection.md) #####User -###### [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md) -###### [Get user information](windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md) -###### [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md) +###### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection.md) +###### [Get user information](get-user-information-windows-defender-advanced-threat-protection.md) +###### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection.md) -### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -#### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md) -#### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md) -#### [Python code examples](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md) -#### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) +### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md) +#### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) +#### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) +#### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) +#### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) +#### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) +#### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) ### [Reporting](reporting.md) -#### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) +#### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) ### [Permissions](permissions.md) #### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md) @@ -339,23 +329,6 @@ - - - - - - - - - - - - - - - - - ##Troubleshoot Windows Defender ATP @@ -388,580 +361,3 @@ -# Other security features -## [The Windows Security app](windows-defender-security-center/windows-defender-security-center.md) -### [Customize the Windows Security app for your organization](windows-defender-security-center/wdsc-customize-contact-information.md) -### [Hide Windows Security app notifications](windows-defender-security-center/wdsc-hide-notifications.md) -### [Manage Windows Security app in Windows 10 in S mode](windows-defender-security-center\wdsc-windows-10-in-s-mode.md) -### [Virus and threat protection](windows-defender-security-center/wdsc-virus-threat-protection.md) -### [Account protection](windows-defender-security-center\wdsc-account-protection.md) -### [Firewall and network protection](windows-defender-security-center\wdsc-firewall-network-protection.md) -### [App and browser control](windows-defender-security-center\wdsc-app-browser-control.md) -### [Device security](windows-defender-security-center\wdsc-device-security.md) -### [Device performance and health](windows-defender-security-center\wdsc-device-performance-health.md) -### [Family options](windows-defender-security-center\wdsc-family-options.md) - - -## [Windows Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) -### [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) -### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) - - -## [Windows Defender Device Guard: virtualization-based security and WDAC](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) - - -## [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) - -## [Mitigate threats by using Windows 10 security features](overview-of-threat-mitigations-in-windows-10.md) - -## [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) - -## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-intrusion-detection.md) - -## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) - -## [Security auditing](auditing/security-auditing-overview.md) - -### [Basic security audit policies](auditing/basic-security-audit-policies.md) -#### [Create a basic audit policy for an event category](auditing/create-a-basic-audit-policy-settings-for-an-event-category.md) -#### [Apply a basic audit policy on a file or folder](auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md) -#### [View the security event log](auditing/view-the-security-event-log.md) - -#### [Basic security audit policy settings](auditing/basic-security-audit-policy-settings.md) -##### [Audit account logon events](auditing/basic-audit-account-logon-events.md) -##### [Audit account management](auditing/basic-audit-account-management.md) -##### [Audit directory service access](auditing/basic-audit-directory-service-access.md) -##### [Audit logon events](auditing/basic-audit-logon-events.md) -##### [Audit object access](auditing/basic-audit-object-access.md) -##### [Audit policy change](auditing/basic-audit-policy-change.md) -##### [Audit privilege use](auditing/basic-audit-privilege-use.md) -##### [Audit process tracking](auditing/basic-audit-process-tracking.md) -##### [Audit system events](auditing/basic-audit-system-events.md) - -#### [Advanced security audit policies](auditing/advanced-security-auditing.md) -##### [Planning and deploying advanced security audit policies](auditing/planning-and-deploying-advanced-security-audit-policies.md) -##### [Advanced security auditing FAQ](auditing/advanced-security-auditing-faq.md) -###### [Which editions of Windows support advanced audit policy configuration](auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md) - -##### [Using advanced security auditing options to monitor dynamic access control objects](auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -###### [Monitor the central access policies that apply on a file server](auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md) -###### [Monitor the use of removable storage devices](auditing/monitor-the-use-of-removable-storage-devices.md) -###### [Monitor resource attribute definitions](auditing/monitor-resource-attribute-definitions.md) -###### [Monitor central access policy and rule definitions](auditing/monitor-central-access-policy-and-rule-definitions.md) -###### [Monitor user and device claims during sign-in](auditing/monitor-user-and-device-claims-during-sign-in.md) -###### [Monitor the resource attributes on files and folders](auditing/monitor-the-resource-attributes-on-files-and-folders.md) -###### [Monitor the central access policies associated with files and folders](auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md) -###### [Monitor claim types](auditing/monitor-claim-types.md) - -##### [Advanced security audit policy settings](auditing/advanced-security-audit-policy-settings.md) -###### [Audit Credential Validation](auditing/audit-credential-validation.md) -###### [Event 4774 S, F: An account was mapped for logon.](auditing/event-4774.md) -###### [Event 4775 F: An account could not be mapped for logon.](auditing/event-4775.md) -###### [Event 4776 S, F: The computer attempted to validate the credentials for an account.](auditing/event-4776.md) -###### [Event 4777 F: The domain controller failed to validate the credentials for an account.](auditing/event-4777.md) -##### [Audit Kerberos Authentication Service](auditing/audit-kerberos-authentication-service.md) -###### [Event 4768 S, F: A Kerberos authentication ticket, TGT, was requested.](auditing/event-4768.md) -###### [Event 4771 F: Kerberos pre-authentication failed.](auditing/event-4771.md) -###### [Event 4772 F: A Kerberos authentication ticket request failed.](auditing/event-4772.md) -##### [Audit Kerberos Service Ticket Operations](auditing/audit-kerberos-service-ticket-operations.md) -###### [Event 4769 S, F: A Kerberos service ticket was requested.](auditing/event-4769.md) -###### [Event 4770 S: A Kerberos service ticket was renewed.](auditing/event-4770.md) -###### [Event 4773 F: A Kerberos service ticket request failed.](auditing/event-4773.md) -##### [Audit Other Account Logon Events](auditing/audit-other-account-logon-events.md) -##### [Audit Application Group Management](auditing/audit-application-group-management.md) -##### [Audit Computer Account Management](auditing/audit-computer-account-management.md) -###### [Event 4741 S: A computer account was created.](auditing/event-4741.md) -###### [Event 4742 S: A computer account was changed.](auditing/event-4742.md) -###### [Event 4743 S: A computer account was deleted.](auditing/event-4743.md) -##### [Audit Distribution Group Management](auditing/audit-distribution-group-management.md) -###### [Event 4749 S: A security-disabled global group was created.](auditing/event-4749.md) -###### [Event 4750 S: A security-disabled global group was changed.](auditing/event-4750.md) -###### [Event 4751 S: A member was added to a security-disabled global group.](auditing/event-4751.md) -###### [Event 4752 S: A member was removed from a security-disabled global group.](auditing/event-4752.md) -###### [Event 4753 S: A security-disabled global group was deleted.](auditing/event-4753.md) -##### [Audit Other Account Management Events](auditing/audit-other-account-management-events.md) -###### [Event 4782 S: The password hash an account was accessed.](auditing/event-4782.md) -###### [Event 4793 S: The Password Policy Checking API was called.](auditing/event-4793.md) -##### [Audit Security Group Management](auditing/audit-security-group-management.md) -###### [Event 4731 S: A security-enabled local group was created.](auditing/event-4731.md) -###### [Event 4732 S: A member was added to a security-enabled local group.](auditing/event-4732.md) -###### [Event 4733 S: A member was removed from a security-enabled local group.](auditing/event-4733.md) -###### [Event 4734 S: A security-enabled local group was deleted.](auditing/event-4734.md) -###### [Event 4735 S: A security-enabled local group was changed.](auditing/event-4735.md) -###### [Event 4764 S: A group’s type was changed.](auditing/event-4764.md) -###### [Event 4799 S: A security-enabled local group membership was enumerated.](auditing/event-4799.md) -##### [Audit User Account Management](auditing/audit-user-account-management.md) -###### [Event 4720 S: A user account was created.](auditing/event-4720.md) -###### [Event 4722 S: A user account was enabled.](auditing/event-4722.md) -###### [Event 4723 S, F: An attempt was made to change an account's password.](auditing/event-4723.md) -###### [Event 4724 S, F: An attempt was made to reset an account's password.](auditing/event-4724.md) -###### [Event 4725 S: A user account was disabled.](auditing/event-4725.md) -###### [Event 4726 S: A user account was deleted.](auditing/event-4726.md) -###### [Event 4738 S: A user account was changed.](auditing/event-4738.md) -###### [Event 4740 S: A user account was locked out.](auditing/event-4740.md) -###### [Event 4765 S: SID History was added to an account.](auditing/event-4765.md) -###### [Event 4766 F: An attempt to add SID History to an account failed.](auditing/event-4766.md) -###### [Event 4767 S: A user account was unlocked.](auditing/event-4767.md) -###### [Event 4780 S: The ACL was set on accounts which are members of administrators groups.](auditing/event-4780.md) -###### [Event 4781 S: The name of an account was changed.](auditing/event-4781.md) -###### [Event 4794 S, F: An attempt was made to set the Directory Services Restore Mode administrator password.](auditing/event-4794.md) -###### [Event 4798 S: A user's local group membership was enumerated.](auditing/event-4798.md) -###### [Event 5376 S: Credential Manager credentials were backed up.](auditing/event-5376.md) -###### [Event 5377 S: Credential Manager credentials were restored from a backup.](auditing/event-5377.md) -##### [Audit DPAPI Activity](auditing/audit-dpapi-activity.md) -###### [Event 4692 S, F: Backup of data protection master key was attempted.](auditing/event-4692.md) -###### [Event 4693 S, F: Recovery of data protection master key was attempted.](auditing/event-4693.md) -###### [Event 4694 S, F: Protection of auditable protected data was attempted.](auditing/event-4694.md) -###### [Event 4695 S, F: Unprotection of auditable protected data was attempted.](auditing/event-4695.md) -##### [Audit PNP Activity](auditing/audit-pnp-activity.md) -###### [Event 6416 S: A new external device was recognized by the System.](auditing/event-6416.md) -###### [Event 6419 S: A request was made to disable a device.](auditing/event-6419.md) -###### [Event 6420 S: A device was disabled.](auditing/event-6420.md) -###### [Event 6421 S: A request was made to enable a device.](auditing/event-6421.md) -###### [Event 6422 S: A device was enabled.](auditing/event-6422.md) -###### [Event 6423 S: The installation of this device is forbidden by system policy.](auditing/event-6423.md) -###### [Event 6424 S: The installation of this device was allowed, after having previously been forbidden by policy.](auditing/event-6424.md) -##### [Audit Process Creation](auditing/audit-process-creation.md) -###### [Event 4688 S: A new process has been created.](auditing/event-4688.md) -###### [Event 4696 S: A primary token was assigned to process.](auditing/event-4696.md) -##### [Audit Process Termination](auditing/audit-process-termination.md) -###### [Event 4689 S: A process has exited.](auditing/event-4689.md) -##### [Audit RPC Events](auditing/audit-rpc-events.md) -###### [Event 5712 S: A Remote Procedure Call, RPC, was attempted.](auditing/event-5712.md) -##### [Audit Detailed Directory Service Replication](auditing/audit-detailed-directory-service-replication.md) -###### [Event 4928 S, F: An Active Directory replica source naming context was established.](auditing/event-4928.md) -###### [Event 4929 S, F: An Active Directory replica source naming context was removed.](auditing/event-4929.md) -###### [Event 4930 S, F: An Active Directory replica source naming context was modified.](auditing/event-4930.md) -###### [Event 4931 S, F: An Active Directory replica destination naming context was modified.](auditing/event-4931.md) -###### [Event 4934 S: Attributes of an Active Directory object were replicated.](auditing/event-4934.md) -###### [Event 4935 F: Replication failure begins.](auditing/event-4935.md) -###### [Event 4936 S: Replication failure ends.](auditing/event-4936.md) -###### [Event 4937 S: A lingering object was removed from a replica.](auditing/event-4937.md) -##### [Audit Directory Service Access](auditing/audit-directory-service-access.md) -###### [Event 4662 S, F: An operation was performed on an object.](auditing/event-4662.md) -###### [Event 4661 S, F: A handle to an object was requested.](auditing/event-4661.md) -##### [Audit Directory Service Changes](auditing/audit-directory-service-changes.md) -###### [Event 5136 S: A directory service object was modified.](auditing/event-5136.md) -###### [Event 5137 S: A directory service object was created.](auditing/event-5137.md) -###### [Event 5138 S: A directory service object was undeleted.](auditing/event-5138.md) -###### [Event 5139 S: A directory service object was moved.](auditing/event-5139.md) -###### [Event 5141 S: A directory service object was deleted.](auditing/event-5141.md) -##### [Audit Directory Service Replication](auditing/audit-directory-service-replication.md) -###### [Event 4932 S: Synchronization of a replica of an Active Directory naming context has begun.](auditing/event-4932.md) -###### [Event 4933 S, F: Synchronization of a replica of an Active Directory naming context has ended.](auditing/event-4933.md) -##### [Audit Account Lockout](auditing/audit-account-lockout.md) -###### [Event 4625 F: An account failed to log on.](auditing/event-4625.md) -##### [Audit User/Device Claims](auditing/audit-user-device-claims.md) -###### [Event 4626 S: User/Device claims information.](auditing/event-4626.md) -##### [Audit Group Membership](auditing/audit-group-membership.md) -###### [Event 4627 S: Group membership information.](auditing/event-4627.md) -##### [Audit IPsec Extended Mode](auditing/audit-ipsec-extended-mode.md) -##### [Audit IPsec Main Mode](auditing/audit-ipsec-main-mode.md) -##### [Audit IPsec Quick Mode](auditing/audit-ipsec-quick-mode.md) -##### [Audit Logoff](auditing/audit-logoff.md) -###### [Event 4634 S: An account was logged off.](auditing/event-4634.md) -###### [Event 4647 S: User initiated logoff.](auditing/event-4647.md) -##### [Audit Logon](auditing/audit-logon.md) -###### [Event 4624 S: An account was successfully logged on.](auditing/event-4624.md) -###### [Event 4625 F: An account failed to log on.](auditing/event-4625.md) -###### [Event 4648 S: A logon was attempted using explicit credentials.](auditing/event-4648.md) -###### [Event 4675 S: SIDs were filtered.](auditing/event-4675.md) -##### [Audit Network Policy Server](auditing/audit-network-policy-server.md) -##### [Audit Other Logon/Logoff Events](auditing/audit-other-logonlogoff-events.md) -###### [Event 4649 S: A replay attack was detected.](auditing/event-4649.md) -###### [Event 4778 S: A session was reconnected to a Window Station.](auditing/event-4778.md) -###### [Event 4779 S: A session was disconnected from a Window Station.](auditing/event-4779.md) -###### [Event 4800 S: The workstation was locked.](auditing/event-4800.md) -###### [Event 4801 S: The workstation was unlocked.](auditing/event-4801.md) -###### [Event 4802 S: The screen saver was invoked.](auditing/event-4802.md) -###### [Event 4803 S: The screen saver was dismissed.](auditing/event-4803.md) -###### [Event 5378 F: The requested credentials delegation was disallowed by policy.](auditing/event-5378.md) -###### [Event 5632 S, F: A request was made to authenticate to a wireless network.](auditing/event-5632.md) -###### [Event 5633 S, F: A request was made to authenticate to a wired network.](auditing/event-5633.md) -##### [Audit Special Logon](auditing/audit-special-logon.md) -###### [Event 4964 S: Special groups have been assigned to a new logon.](auditing/event-4964.md) -###### [Event 4672 S: Special privileges assigned to new logon.](auditing/event-4672.md) -##### [Audit Application Generated](auditing/audit-application-generated.md) -##### [Audit Certification Services](auditing/audit-certification-services.md) -##### [Audit Detailed File Share](auditing/audit-detailed-file-share.md) -###### [Event 5145 S, F: A network share object was checked to see whether client can be granted desired access.](auditing/event-5145.md) -##### [Audit File Share](auditing/audit-file-share.md) -###### [Event 5140 S, F: A network share object was accessed.](auditing/event-5140.md) -###### [Event 5142 S: A network share object was added.](auditing/event-5142.md) -###### [Event 5143 S: A network share object was modified.](auditing/event-5143.md) -###### [Event 5144 S: A network share object was deleted.](auditing/event-5144.md) -###### [Event 5168 F: SPN check for SMB/SMB2 failed.](auditing/event-5168.md) -##### [Audit File System](auditing/audit-file-system.md) -###### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) -###### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) -###### [Event 4660 S: An object was deleted.](auditing/event-4660.md) -###### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) -###### [Event 4664 S: An attempt was made to create a hard link.](auditing/event-4664.md) -###### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) -###### [Event 5051: A file was virtualized.](auditing/event-5051.md) -###### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) -##### [Audit Filtering Platform Connection](auditing/audit-filtering-platform-connection.md) -###### [Event 5031 F: The Windows Firewall Service blocked an application from accepting incoming connections on the network.](auditing/event-5031.md) -###### [Event 5150: The Windows Filtering Platform blocked a packet.](auditing/event-5150.md) -###### [Event 5151: A more restrictive Windows Filtering Platform filter has blocked a packet.](auditing/event-5151.md) -###### [Event 5154 S: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.](auditing/event-5154.md) -###### [Event 5155 F: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.](auditing/event-5155.md) -###### [Event 5156 S: The Windows Filtering Platform has permitted a connection.](auditing/event-5156.md) -###### [Event 5157 F: The Windows Filtering Platform has blocked a connection.](auditing/event-5157.md) -###### [Event 5158 S: The Windows Filtering Platform has permitted a bind to a local port.](auditing/event-5158.md) -###### [Event 5159 F: The Windows Filtering Platform has blocked a bind to a local port.](auditing/event-5159.md) -##### [Audit Filtering Platform Packet Drop](auditing/audit-filtering-platform-packet-drop.md) -###### [Event 5152 F: The Windows Filtering Platform blocked a packet.](auditing/event-5152.md) -###### [Event 5153 S: A more restrictive Windows Filtering Platform filter has blocked a packet.](auditing/event-5153.md) -##### [Audit Handle Manipulation](auditing/audit-handle-manipulation.md) -###### [Event 4690 S: An attempt was made to duplicate a handle to an object.](auditing/event-4690.md) -##### [Audit Kernel Object](auditing/audit-kernel-object.md) -###### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) -###### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) -###### [Event 4660 S: An object was deleted.](auditing/event-4660.md) -###### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) -##### [Audit Other Object Access Events](auditing/audit-other-object-access-events.md) -###### [Event 4671: An application attempted to access a blocked ordinal through the TBS.](auditing/event-4671.md) -###### [Event 4691 S: Indirect access to an object was requested.](auditing/event-4691.md) -###### [Event 5148 F: The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.](auditing/event-5148.md) -###### [Event 5149 F: The DoS attack has subsided and normal processing is being resumed.](auditing/event-5149.md) -###### [Event 4698 S: A scheduled task was created.](auditing/event-4698.md) -###### [Event 4699 S: A scheduled task was deleted.](auditing/event-4699.md) -###### [Event 4700 S: A scheduled task was enabled.](auditing/event-4700.md) -###### [Event 4701 S: A scheduled task was disabled.](auditing/event-4701.md) -###### [Event 4702 S: A scheduled task was updated.](auditing/event-4702.md) -###### [Event 5888 S: An object in the COM+ Catalog was modified.](auditing/event-5888.md) -###### [Event 5889 S: An object was deleted from the COM+ Catalog.](auditing/event-5889.md) -###### [Event 5890 S: An object was added to the COM+ Catalog.](auditing/event-5890.md) -##### [Audit Registry](auditing/audit-registry.md) -###### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) -###### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) -###### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) -###### [Event 4660 S: An object was deleted.](auditing/event-4660.md) -###### [Event 4657 S: A registry value was modified.](auditing/event-4657.md) -###### [Event 5039: A registry key was virtualized.](auditing/event-5039.md) -###### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) -##### [Audit Removable Storage](auditing/audit-removable-storage.md) -##### [Audit SAM](auditing/audit-sam.md) -###### [Event 4661 S, F: A handle to an object was requested.](auditing/event-4661.md) -##### [Audit Central Access Policy Staging](auditing/audit-central-access-policy-staging.md) -###### [Event 4818 S: Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy.](auditing/event-4818.md) -##### [Audit Audit Policy Change](auditing/audit-audit-policy-change.md) -###### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) -###### [Event 4715 S: The audit policy, SACL, on an object was changed.](auditing/event-4715.md) -###### [Event 4719 S: System audit policy was changed.](auditing/event-4719.md) -###### [Event 4817 S: Auditing settings on object were changed.](auditing/event-4817.md) -###### [Event 4902 S: The Per-user audit policy table was created.](auditing/event-4902.md) -###### [Event 4906 S: The CrashOnAuditFail value has changed.](auditing/event-4906.md) -###### [Event 4907 S: Auditing settings on object were changed.](auditing/event-4907.md) -###### [Event 4908 S: Special Groups Logon table modified.](auditing/event-4908.md) -###### [Event 4912 S: Per User Audit Policy was changed.](auditing/event-4912.md) -###### [Event 4904 S: An attempt was made to register a security event source.](auditing/event-4904.md) -###### [Event 4905 S: An attempt was made to unregister a security event source.](auditing/event-4905.md) -##### [Audit Authentication Policy Change](auditing/audit-authentication-policy-change.md) -###### [Event 4706 S: A new trust was created to a domain.](auditing/event-4706.md) -###### [Event 4707 S: A trust to a domain was removed.](auditing/event-4707.md) -###### [Event 4716 S: Trusted domain information was modified.](auditing/event-4716.md) -###### [Event 4713 S: Kerberos policy was changed.](auditing/event-4713.md) -###### [Event 4717 S: System security access was granted to an account.](auditing/event-4717.md) -###### [Event 4718 S: System security access was removed from an account.](auditing/event-4718.md) -###### [Event 4739 S: Domain Policy was changed.](auditing/event-4739.md) -###### [Event 4864 S: A namespace collision was detected.](auditing/event-4864.md) -###### [Event 4865 S: A trusted forest information entry was added.](auditing/event-4865.md) -###### [Event 4866 S: A trusted forest information entry was removed.](auditing/event-4866.md) -###### [Event 4867 S: A trusted forest information entry was modified.](auditing/event-4867.md) -##### [Audit Authorization Policy Change](auditing/audit-authorization-policy-change.md) -###### [Event 4703 S: A user right was adjusted.](auditing/event-4703.md) -###### [Event 4704 S: A user right was assigned.](auditing/event-4704.md) -###### [Event 4705 S: A user right was removed.](auditing/event-4705.md) -###### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) -###### [Event 4911 S: Resource attributes of the object were changed.](auditing/event-4911.md) -###### [Event 4913 S: Central Access Policy on the object was changed.](auditing/event-4913.md) -##### [Audit Filtering Platform Policy Change](auditing/audit-filtering-platform-policy-change.md) -##### [Audit MPSSVC Rule-Level Policy Change](auditing/audit-mpssvc-rule-level-policy-change.md) -###### [Event 4944 S: The following policy was active when the Windows Firewall started.](auditing/event-4944.md) -###### [Event 4945 S: A rule was listed when the Windows Firewall started.](auditing/event-4945.md) -###### [Event 4946 S: A change has been made to Windows Firewall exception list. A rule was added.](auditing/event-4946.md) -###### [Event 4947 S: A change has been made to Windows Firewall exception list. A rule was modified.](auditing/event-4947.md) -###### [Event 4948 S: A change has been made to Windows Firewall exception list. A rule was deleted.](auditing/event-4948.md) -###### [Event 4949 S: Windows Firewall settings were restored to the default values.](auditing/event-4949.md) -###### [Event 4950 S: A Windows Firewall setting has changed.](auditing/event-4950.md) -###### [Event 4951 F: A rule has been ignored because its major version number was not recognized by Windows Firewall.](auditing/event-4951.md) -###### [Event 4952 F: Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.](auditing/event-4952.md) -###### [Event 4953 F: Windows Firewall ignored a rule because it could not be parsed.](auditing/event-4953.md) -###### [Event 4954 S: Windows Firewall Group Policy settings have changed. The new settings have been applied.](auditing/event-4954.md) -###### [Event 4956 S: Windows Firewall has changed the active profile.](auditing/event-4956.md) -###### [Event 4957 F: Windows Firewall did not apply the following rule.](auditing/event-4957.md) -###### [Event 4958 F: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.](auditing/event-4958.md) -##### [Audit Other Policy Change Events](auditing/audit-other-policy-change-events.md) -###### [Event 4714 S: Encrypted data recovery policy was changed.](auditing/event-4714.md) -###### [Event 4819 S: Central Access Policies on the machine have been changed.](auditing/event-4819.md) -###### [Event 4826 S: Boot Configuration Data loaded.](auditing/event-4826.md) -###### [Event 4909: The local policy settings for the TBS were changed.](auditing/event-4909.md) -###### [Event 4910: The group policy settings for the TBS were changed.](auditing/event-4910.md) -###### [Event 5063 S, F: A cryptographic provider operation was attempted.](auditing/event-5063.md) -###### [Event 5064 S, F: A cryptographic context operation was attempted.](auditing/event-5064.md) -###### [Event 5065 S, F: A cryptographic context modification was attempted.](auditing/event-5065.md) -###### [Event 5066 S, F: A cryptographic function operation was attempted.](auditing/event-5066.md) -###### [Event 5067 S, F: A cryptographic function modification was attempted.](auditing/event-5067.md) -###### [Event 5068 S, F: A cryptographic function provider operation was attempted.](auditing/event-5068.md) -###### [Event 5069 S, F: A cryptographic function property operation was attempted.](auditing/event-5069.md) -###### [Event 5070 S, F: A cryptographic function property modification was attempted.](auditing/event-5070.md) -###### [Event 5447 S: A Windows Filtering Platform filter has been changed.](auditing/event-5447.md) -###### [Event 6144 S: Security policy in the group policy objects has been applied successfully.](auditing/event-6144.md) -###### [Event 6145 F: One or more errors occurred while processing security policy in the group policy objects.](auditing/event-6145.md) -##### [Audit Sensitive Privilege Use](auditing/audit-sensitive-privilege-use.md) -###### [Event 4673 S, F: A privileged service was called.](auditing/event-4673.md) -###### [Event 4674 S, F: An operation was attempted on a privileged object.](auditing/event-4674.md) -###### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) -##### [Audit Non Sensitive Privilege Use](auditing/audit-non-sensitive-privilege-use.md) -###### [Event 4673 S, F: A privileged service was called.](auditing/event-4673.md) -###### [Event 4674 S, F: An operation was attempted on a privileged object.](auditing/event-4674.md) -###### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) -##### [Audit Other Privilege Use Events](auditing/audit-other-privilege-use-events.md) -###### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) -##### [Audit IPsec Driver](auditing/audit-ipsec-driver.md) -##### [Audit Other System Events](auditing/audit-other-system-events.md) -###### [Event 5024 S: The Windows Firewall Service has started successfully.](auditing/event-5024.md) -###### [Event 5025 S: The Windows Firewall Service has been stopped.](auditing/event-5025.md) -###### [Event 5027 F: The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.](auditing/event-5027.md) -###### [Event 5028 F: The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.](auditing/event-5028.md) -###### [Event 5029 F: The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.](auditing/event-5029.md) -###### [Event 5030 F: The Windows Firewall Service failed to start.](auditing/event-5030.md) -###### [Event 5032 F: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.](auditing/event-5032.md) -###### [Event 5033 S: The Windows Firewall Driver has started successfully.](auditing/event-5033.md) -###### [Event 5034 S: The Windows Firewall Driver was stopped.](auditing/event-5034.md) -###### [Event 5035 F: The Windows Firewall Driver failed to start.](auditing/event-5035.md) -###### [Event 5037 F: The Windows Firewall Driver detected critical runtime error. Terminating.](auditing/event-5037.md) -###### [Event 5058 S, F: Key file operation.](auditing/event-5058.md) -###### [Event 5059 S, F: Key migration operation.](auditing/event-5059.md) -###### [Event 6400: BranchCache: Received an incorrectly formatted response while discovering availability of content.](auditing/event-6400.md) -###### [Event 6401: BranchCache: Received invalid data from a peer. Data discarded.](auditing/event-6401.md) -###### [Event 6402: BranchCache: The message to the hosted cache offering it data is incorrectly formatted.](auditing/event-6402.md) -###### [Event 6403: BranchCache: The hosted cache sent an incorrectly formatted response to the client.](auditing/event-6403.md) -###### [Event 6404: BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.](auditing/event-6404.md) -###### [Event 6405: BranchCache: %2 instances of event id %1 occurred.](auditing/event-6405.md) -###### [Event 6406: %1 registered to Windows Firewall to control filtering for the following: %2.](auditing/event-6406.md) -###### [Event 6407: 1%.](auditing/event-6407.md) -###### [Event 6408: Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.](auditing/event-6408.md) -###### [Event 6409: BranchCache: A service connection point object could not be parsed.](auditing/event-6409.md) -##### [Audit Security State Change](auditing/audit-security-state-change.md) -###### [Event 4608 S: Windows is starting up.](auditing/event-4608.md) -###### [Event 4616 S: The system time was changed.](auditing/event-4616.md) -###### [Event 4621 S: Administrator recovered system from CrashOnAuditFail.](auditing/event-4621.md) -##### [Audit Security System Extension](auditing/audit-security-system-extension.md) -###### [Event 4610 S: An authentication package has been loaded by the Local Security Authority.](auditing/event-4610.md) -###### [Event 4611 S: A trusted logon process has been registered with the Local Security Authority.](auditing/event-4611.md) -###### [Event 4614 S: A notification package has been loaded by the Security Account Manager.](auditing/event-4614.md) -###### [Event 4622 S: A security package has been loaded by the Local Security Authority.](auditing/event-4622.md) -###### [Event 4697 S: A service was installed in the system.](auditing/event-4697.md) -##### [Audit System Integrity](auditing/audit-system-integrity.md) -###### [Event 4612 S: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.](auditing/event-4612.md) -###### [Event 4615 S: Invalid use of LPC port.](auditing/event-4615.md) -###### [Event 4618 S: A monitored security event pattern has occurred.](auditing/event-4618.md) -###### [Event 4816 S: RPC detected an integrity violation while decrypting an incoming message.](auditing/event-4816.md) -###### [Event 5038 F: Code integrity determined that the image hash of a file is not valid.](auditing/event-5038.md) -###### [Event 5056 S: A cryptographic self-test was performed.](auditing/event-5056.md) -###### [Event 5062 S: A kernel-mode cryptographic self-test was performed.](auditing/event-5062.md) -###### [Event 5057 F: A cryptographic primitive operation failed.](auditing/event-5057.md) -###### [Event 5060 F: Verification operation failed.](auditing/event-5060.md) -###### [Event 5061 S, F: Cryptographic operation.](auditing/event-5061.md) -###### [Event 6281 F: Code Integrity determined that the page hashes of an image file are not valid.](auditing/event-6281.md) -###### [Event 6410 F: Code integrity determined that a file does not meet the security requirements to load into a process.](auditing/event-6410.md) -##### [Other Events](auditing/other-events.md) -###### [Event 1100 S: The event logging service has shut down.](auditing/event-1100.md) -###### [Event 1102 S: The audit log was cleared.](auditing/event-1102.md) -###### [Event 1104 S: The security log is now full.](auditing/event-1104.md) -###### [Event 1105 S: Event log automatic backup.](auditing/event-1105.md) -###### [Event 1108 S: The event logging service encountered an error while processing an incoming event published from %1.](auditing/event-1108.md) -##### [Appendix A: Security monitoring recommendations for many audit events](auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md) -##### [Registry (Global Object Access Auditing) ](auditing/registry-global-object-access-auditing.md) -##### [File System (Global Object Access Auditing) ](auditing/file-system-global-object-access-auditing.md) - - - - - -### [Security policy settings](security-policy-settings/security-policy-settings.md) -### [Administer security policy settings](security-policy-settings/administer-security-policy-settings.md) -#### [Network List Manager policies](security-policy-settings/network-list-manager-policies.md) -### [Configure security policy settings](security-policy-settings/how-to-configure-security-policy-settings.md) -### [Security policy settings reference](security-policy-settings/security-policy-settings-reference.md) -#### [Account Policies](security-policy-settings/account-policies.md) -##### [Password Policy](security-policy-settings/password-policy.md) -###### [Enforce password history](security-policy-settings/enforce-password-history.md) -###### [Maximum password age](security-policy-settings/maximum-password-age.md) -###### [Minimum password age](security-policy-settings/minimum-password-age.md) -###### [Minimum password length](security-policy-settings/minimum-password-length.md) -###### [Password must meet complexity requirements](security-policy-settings/password-must-meet-complexity-requirements.md) -###### [Store passwords using reversible encryption](security-policy-settings/store-passwords-using-reversible-encryption.md) -##### [Account Lockout Policy](security-policy-settings/account-lockout-policy.md) -###### [Account lockout duration](security-policy-settings/account-lockout-duration.md) -###### [Account lockout threshold](security-policy-settings/account-lockout-threshold.md) -###### [Reset account lockout counter after](security-policy-settings/reset-account-lockout-counter-after.md) -##### [Kerberos Policy](security-policy-settings/kerberos-policy.md) -###### [Enforce user logon restrictions](security-policy-settings/enforce-user-logon-restrictions.md) -###### [Maximum lifetime for service ticket](security-policy-settings/maximum-lifetime-for-service-ticket.md) -###### [Maximum lifetime for user ticket](security-policy-settings/maximum-lifetime-for-user-ticket.md) -###### [Maximum lifetime for user ticket renewal](security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md) -###### [Maximum tolerance for computer clock synchronization](security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md) -#### [Audit Policy](security-policy-settings/audit-policy.md) -#### [Security Options](security-policy-settings/security-options.md) -##### [Accounts: Administrator account status](security-policy-settings/accounts-administrator-account-status.md) -##### [Accounts: Block Microsoft accounts](security-policy-settings/accounts-block-microsoft-accounts.md) -##### [Accounts: Guest account status](security-policy-settings/accounts-guest-account-status.md) -##### [Accounts: Limit local account use of blank passwords to console logon only](security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md) -##### [Accounts: Rename administrator account](security-policy-settings/accounts-rename-administrator-account.md) -##### [Accounts: Rename guest account](security-policy-settings/accounts-rename-guest-account.md) -##### [Audit: Audit the access of global system objects](security-policy-settings/audit-audit-the-access-of-global-system-objects.md) -##### [Audit: Audit the use of Backup and Restore privilege](security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md) -##### [Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings](security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md) -##### [Audit: Shut down system immediately if unable to log security audits](security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md) -##### [DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax](security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md) -##### [DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax](security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md) -##### [Devices: Allow undock without having to log on](security-policy-settings/devices-allow-undock-without-having-to-log-on.md) -##### [Devices: Allowed to format and eject removable media](security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md) -##### [Devices: Prevent users from installing printer drivers](security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md) -##### [Devices: Restrict CD-ROM access to locally logged-on user only](security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md) -##### [Devices: Restrict floppy access to locally logged-on user only](security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md) -##### [Domain controller: Allow server operators to schedule tasks](security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md) -##### [Domain controller: LDAP server signing requirements](security-policy-settings/domain-controller-ldap-server-signing-requirements.md) -##### [Domain controller: Refuse machine account password changes](security-policy-settings/domain-controller-refuse-machine-account-password-changes.md) -##### [Domain member: Digitally encrypt or sign secure channel data (always)](security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) -##### [Domain member: Digitally encrypt secure channel data (when possible)](security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md) -##### [Domain member: Digitally sign secure channel data (when possible)](security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md) -##### [Domain member: Disable machine account password changes](security-policy-settings/domain-member-disable-machine-account-password-changes.md) -##### [Domain member: Maximum machine account password age](security-policy-settings/domain-member-maximum-machine-account-password-age.md) -##### [Domain member: Require strong (Windows 2000 or later) session key](security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md) -##### [Interactive logon: Display user information when the session is locked](security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md) -##### [Interactive logon: Don't display last signed-in](security-policy-settings/interactive-logon-do-not-display-last-user-name.md) -##### [Interactive logon: Don't display username at sign-in](security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md) -##### [Interactive logon: Do not require CTRL+ALT+DEL](security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md) -##### [Interactive logon: Machine account lockout threshold](security-policy-settings/interactive-logon-machine-account-lockout-threshold.md) -##### [Interactive logon: Machine inactivity limit](security-policy-settings/interactive-logon-machine-inactivity-limit.md) -##### [Interactive logon: Message text for users attempting to log on](security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md) -##### [Interactive logon: Message title for users attempting to log on](security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md) -##### [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) -##### [Interactive logon: Prompt user to change password before expiration](security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md) -##### [Interactive logon: Require Domain Controller authentication to unlock workstation](security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md) -##### [Interactive logon: Require smart card](security-policy-settings/interactive-logon-require-smart-card.md) -##### [Interactive logon: Smart card removal behavior](security-policy-settings/interactive-logon-smart-card-removal-behavior.md) -##### [Microsoft network client: Digitally sign communications (always)](security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md) -##### [SMBv1 Microsoft network client: Digitally sign communications (always)](security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-always.md) -##### [SMBv1 Microsoft network client: Digitally sign communications (if server agrees)](security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees.md) -##### [Microsoft network client: Send unencrypted password to third-party SMB servers](security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md) -##### [Microsoft network server: Amount of idle time required before suspending session](security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md) -##### [Microsoft network server: Attempt S4U2Self to obtain claim information](security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md) -##### [Microsoft network server: Digitally sign communications (always)](security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md) -##### [SMBv1 Microsoft network server: Digitally sign communications (always)](security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md) -##### [SMBv1 Microsoft network server: Digitally sign communications (if client agrees)](security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md) -##### [Microsoft network server: Disconnect clients when logon hours expire](security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md) -##### [Microsoft network server: Server SPN target name validation level](security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md) -##### [Network access: Allow anonymous SID/Name translation](security-policy-settings/network-access-allow-anonymous-sidname-translation.md) -##### [Network access: Do not allow anonymous enumeration of SAM accounts](security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md) -##### [Network access: Do not allow anonymous enumeration of SAM accounts and shares](security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md) -##### [Network access: Do not allow storage of passwords and credentials for network authentication](security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md) -##### [Network access: Let Everyone permissions apply to anonymous users](security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md) -##### [Network access: Named Pipes that can be accessed anonymously](security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md) -##### [Network access: Remotely accessible registry paths](security-policy-settings/network-access-remotely-accessible-registry-paths.md) -##### [Network access: Remotely accessible registry paths and subpaths](security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md) -##### [Network access: Restrict anonymous access to Named Pipes and Shares](security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md) -##### [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md) -##### [Network access: Shares that can be accessed anonymously](security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md) -##### [Network access: Sharing and security model for local accounts](security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md) -##### [Network security: Allow Local System to use computer identity for NTLM](security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) -##### [Network security: Allow LocalSystem NULL session fallback](security-policy-settings/network-security-allow-localsystem-null-session-fallback.md) -##### [Network security: Allow PKU2U authentication requests to this computer to use online identities](security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md) -##### [Network security: Configure encryption types allowed for Kerberos Win7 only](security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md) -##### [Network security: Do not store LAN Manager hash value on next password change](security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md) -##### [Network security: Force logoff when logon hours expire](security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md) -##### [Network security: LAN Manager authentication level](security-policy-settings/network-security-lan-manager-authentication-level.md) -##### [Network security: LDAP client signing requirements](security-policy-settings/network-security-ldap-client-signing-requirements.md) -##### [Network security: Minimum session security for NTLM SSP based (including secure RPC) clients](security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md) -##### [Network security: Minimum session security for NTLM SSP based (including secure RPC) servers](security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md) -##### [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md) -##### [Network security: Restrict NTLM: Add server exceptions in this domain](security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md) -##### [Network security: Restrict NTLM: Audit incoming NTLM traffic](security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md) -##### [Network security: Restrict NTLM: Audit NTLM authentication in this domain](security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md) -##### [Network security: Restrict NTLM: Incoming NTLM traffic](security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md) -##### [Network security: Restrict NTLM: NTLM authentication in this domain](security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md) -##### [Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) -##### [Recovery console: Allow automatic administrative logon](security-policy-settings/recovery-console-allow-automatic-administrative-logon.md) -##### [Recovery console: Allow floppy copy and access to all drives and folders](security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md) -##### [Shutdown: Allow system to be shut down without having to log on](security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md) -##### [Shutdown: Clear virtual memory pagefile](security-policy-settings/shutdown-clear-virtual-memory-pagefile.md) -##### [System cryptography: Force strong key protection for user keys stored on the computer](security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md) -##### [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md) -##### [System objects: Require case insensitivity for non-Windows subsystems](security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md) -##### [System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)](security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md) -##### [System settings: Optional subsystems](security-policy-settings/system-settings-optional-subsystems.md) -##### [System settings: Use certificate rules on Windows executables for Software Restriction Policies](security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md) -##### [User Account Control: Admin Approval Mode for the Built-in Administrator account](security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md) -##### [User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop](security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md) -##### [User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode](security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md) -##### [User Account Control: Behavior of the elevation prompt for standard users](security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md) -##### [User Account Control: Detect application installations and prompt for elevation](security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md) -##### [User Account Control: Only elevate executables that are signed and validated](security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md) -##### [User Account Control: Only elevate UIAccess applications that are installed in secure locations](security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md) -##### [User Account Control: Run all administrators in Admin Approval Mode](security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md) -##### [User Account Control: Switch to the secure desktop when prompting for elevation](security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md) -##### [User Account Control: Virtualize file and registry write failures to per-user locations](security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md) -#### [Advanced security audit policy settings](security-policy-settings/secpol-advanced-security-audit-policy-settings.md) -#### [User Rights Assignment](security-policy-settings/user-rights-assignment.md) -##### [Access Credential Manager as a trusted caller](security-policy-settings/access-credential-manager-as-a-trusted-caller.md) -##### [Access this computer from the network](security-policy-settings/access-this-computer-from-the-network.md) -##### [Act as part of the operating system](security-policy-settings/act-as-part-of-the-operating-system.md) -##### [Add workstations to domain](security-policy-settings/add-workstations-to-domain.md) -##### [Adjust memory quotas for a process](security-policy-settings/adjust-memory-quotas-for-a-process.md) -##### [Allow log on locally](security-policy-settings/allow-log-on-locally.md) -##### [Allow log on through Remote Desktop Services](security-policy-settings/allow-log-on-through-remote-desktop-services.md) -##### [Back up files and directories](security-policy-settings/back-up-files-and-directories.md) -##### [Bypass traverse checking](security-policy-settings/bypass-traverse-checking.md) -##### [Change the system time](security-policy-settings/change-the-system-time.md) -##### [Change the time zone](security-policy-settings/change-the-time-zone.md) -##### [Create a pagefile](security-policy-settings/create-a-pagefile.md) -##### [Create a token object](security-policy-settings/create-a-token-object.md) -##### [Create global objects](security-policy-settings/create-global-objects.md) -##### [Create permanent shared objects](security-policy-settings/create-permanent-shared-objects.md) -##### [Create symbolic links](security-policy-settings/create-symbolic-links.md) -##### [Debug programs](security-policy-settings/debug-programs.md) -##### [Deny access to this computer from the network](security-policy-settings/deny-access-to-this-computer-from-the-network.md) -##### [Deny log on as a batch job](security-policy-settings/deny-log-on-as-a-batch-job.md) -##### [Deny log on as a service](security-policy-settings/deny-log-on-as-a-service.md) -##### [Deny log on locally](security-policy-settings/deny-log-on-locally.md) -##### [Deny log on through Remote Desktop Services](security-policy-settings/deny-log-on-through-remote-desktop-services.md) -##### [Enable computer and user accounts to be trusted for delegation](security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md) -##### [Force shutdown from a remote system](security-policy-settings/force-shutdown-from-a-remote-system.md) -##### [Generate security audits](security-policy-settings/generate-security-audits.md) -##### [Impersonate a client after authentication](security-policy-settings/impersonate-a-client-after-authentication.md) -##### [Increase a process working set](security-policy-settings/increase-a-process-working-set.md) -##### [Increase scheduling priority](security-policy-settings/increase-scheduling-priority.md) -##### [Load and unload device drivers](security-policy-settings/load-and-unload-device-drivers.md) -##### [Lock pages in memory](security-policy-settings/lock-pages-in-memory.md) -##### [Log on as a batch job](security-policy-settings/log-on-as-a-batch-job.md) -##### [Log on as a service](security-policy-settings/log-on-as-a-service.md) -##### [Manage auditing and security log](security-policy-settings/manage-auditing-and-security-log.md) -##### [Modify an object label](security-policy-settings/modify-an-object-label.md) -##### [Modify firmware environment values](security-policy-settings/modify-firmware-environment-values.md) -##### [Perform volume maintenance tasks](security-policy-settings/perform-volume-maintenance-tasks.md) -##### [Profile single process](security-policy-settings/profile-single-process.md) -##### [Profile system performance](security-policy-settings/profile-system-performance.md) -##### [Remove computer from docking station](security-policy-settings/remove-computer-from-docking-station.md) -##### [Replace a process level token](security-policy-settings/replace-a-process-level-token.md) -##### [Restore files and directories](security-policy-settings/restore-files-and-directories.md) -##### [Shut down the system](security-policy-settings/shut-down-the-system.md) -##### [Synchronize directory service data](security-policy-settings/synchronize-directory-service-data.md) -##### [Take ownership of files or other objects](security-policy-settings/take-ownership-of-files-or-other-objects.md) - - - - - - -## [Windows security baselines](windows-security-baselines.md) -## [Security Compliance Toolkit](security-compliance-toolkit-10.md) -## [Get support](get-support-for-security-baselines.md) - -## [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) - -## [Change history for Threat protection](change-history-for-threat-protection.md) From c3f7e909487ef0e1df55e4b0174fe0fa52971f28 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 15:23:52 +0300 Subject: [PATCH 016/286] fix links --- windows/security/threat-protection/TOC.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 2340e23606..a14975455d 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -15,8 +15,8 @@ #### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) -#### [Evaluate Windows Defender ATP](evaluate.md) -##### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +#### [Evaluate Windows Defender ATP](../../evaluate.md) +##### [Evaluate Attack surface reduction - ASR controls](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) ##### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) ##### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) ##### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) From 0f2a5707fec1b6e73ae8adb0e29ca16972c6b1e3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 15:26:11 +0300 Subject: [PATCH 017/286] fix links --- windows/security/threat-protection/TOC.md | 1307 ++++++--------------- 1 file changed, 342 insertions(+), 965 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index a14975455d..8fe3e22d50 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -1,974 +1,351 @@ -# [Threat protection](index.md) - - - - - - -## [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) - -### [Get started](fake2.md) -#### [Minimum requirements](windows-defender-atp\minimum-requirements-windows-defender-advanced-threat-protection.md) -#### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) -#### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md) -#### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) -#### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) - -#### [Evaluate Windows Defender ATP](../../evaluate.md) -##### [Evaluate Attack surface reduction - ASR controls](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) -##### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) -##### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) -##### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) -##### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) -##### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) -##### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) -##### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) - - - -### [Onboard and configure machines to Windows Defender ATP](onboard.md) -#### [Onboard machines - need to revise this page](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) -##### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md) -##### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md) -###### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md) -###### [Onboard machines using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -###### [Onboard machines using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -####### [Onboard machines using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) -###### [Onboard machines using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md) -###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) -##### [Onboard servers](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md) -##### [Onboard non-Windows machines](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) -##### [Run a detection test on a newly onboarded machine](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md) -##### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) -##### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) -##### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) - - - - -####[Configure ASR](configure1.md) -##### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) -##### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -##### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) - - - - - - -#### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) -##### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) -##### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) -###### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) - -##### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) -###### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) -####### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) -###### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) -####### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) -###### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) -####### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) -####### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) -####### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) -####### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) -####### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) - -##### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) -###### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md) -####### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) -###### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) -###### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md) -###### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md) -###### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md) -###### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) -###### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) -##### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) -##### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) -###### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) -###### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) -###### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) -###### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) -###### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) - - - - - -#### [Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) - - - -#### [Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) -#####General -###### [Update data retention settings](windows-defender-atp\data-retention-settings-windows-defender-advanced-threat-protection.md) -###### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md) -###### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md) -###### [Enable Secure score security controls](windows-defender-atp\enable-secure-score-windows-defender-advanced-threat-protection.md) -###### [Configure advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md) - - - - -#####APIs -###### [Enable Threat intel](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md) - -#####Rules -###### [Manage suppression rules](windows-defender-atp\manage-suppression-rules-windows-defender-advanced-threat-protection.md) -###### [Manage automation allowed/blocked](windows-defender-atp\manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -###### [Manage automation file uploads](windows-defender-atp\manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) -###### [Manage automation folder exclusions](windows-defender-atp\manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) - -#####Machine management -###### [Onboarding machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) -###### [Offboarding machines](windows-defender-atp\offboard-machines-windows-defender-advanced-threat-protection.md) - -##### [Configure Windows Defender Security Center time zone settings](windows-defender-atp\time-settings-windows-defender-advanced-threat-protection.md) - - - - -### [Windows Defender Security Center](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) -#### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) -#### [View the Security operations dashboard - consdier moving to the relevant pillar](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) - -#### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) - - - - - - - - - - - - - -### [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) -#### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) -##### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) -#### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) - - -#### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) -##### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) - -##### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) -##### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) -###### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) - -#### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) - -##### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) -##### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) -#### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) - -##### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) -##### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) - - - -##### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) -##### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) -##### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) - -### [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) -#### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -##### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) -##### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) -##### [Configure and validate network connections](windows-defender-antivirus\configure-network-connections-windows-defender-antivirus.md) -##### [Enable the Block at First Sight feature](windows-defender-antivirus\configure-block-at-first-sight-windows-defender-antivirus.md) -##### [Configure the cloud block timeout period](windows-defender-antivirus\configure-cloud-block-timeout-period-windows-defender-antivirus.md) -#### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus\configure-protection-features-windows-defender-antivirus.md) -##### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus\detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) -##### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md) - - - -### [Endpoint detection and response - Tomer B.](faketopic.md) -####Alerts queue -##### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) -##### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md) -##### [Investigate alerts](windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md) -##### [Investigate files](windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md) -##### [Investigate machines](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md) -##### [Investigate an IP address](windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md) -##### [Investigate a domain](windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md) -##### [Investigate a user account](windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md) - -####Machines list -##### [View and organize the Machines list](windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md) -##### [Manage machine group and tags](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) -##### [Alerts related to this machine](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) -##### [Machine timeline](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) -###### [Search for specific events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) -###### [Filter events from a specific date](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) -###### [Export machine timeline events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) -###### [Navigate between pages](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) - - -#### [Take response actions](windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md) -##### [Take response actions on a machine](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md) -###### [Collect investigation package](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) -###### [Run antivirus scan](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) -###### [Restrict app execution](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) -###### [Remove app restriction](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) -###### [Isolate machines from the network](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) -###### [Release machine from isolation](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) -###### [Check activity details in Action center](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) - -##### [Take response actions on a file](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md) -###### [Stop and quarantine files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) -###### [Remove file from quarantine](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) -###### [Block files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) -###### [Remove file from blocked list](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) -###### [Check activity details in Action center](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) -###### [Deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) -###### [Submit files for analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) -###### [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) -###### [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) - - - -#### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) -##### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) -##### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) - - -### [Automatic investigation and remediation - Benny](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) - - -###Security posture -#### [Secure posture - Evald](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) -#### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) - - - -### [Management and APIs](management-apis.md) -#### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) -##### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) -##### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md) -##### [Configure HP ArcSight to pull alerts](windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md) -##### [Windows Defender ATP alert API fields](windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md) -##### [Pull alerts using REST API](windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) -##### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md) - -#### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md) -##### [Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md) -######Actor -####### [Get actor information](windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md) -####### [Get actor related alerts](windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md) -######Alerts -####### [Get alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md) -####### [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md) -####### [Get alert related actor information](windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) -####### [Get alert related domain information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) -####### [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md) -####### [Get alert related IP information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) -####### [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) -#######Domain -######## [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md) -######## [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md) -######## [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md) -######## [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) - -######File -####### [Block file API](windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md) -####### [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md) -####### [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md) -####### [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md) -####### [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md) -####### [Get FileActions collection API](windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md) -####### [Unblock file API](windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md) - -######IP -####### [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md) -####### [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md) -####### [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md) -####### [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md) -######Machines -####### [Collect investigation package API](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md) -####### [Find machine information by IP](windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) -####### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) -####### [Get FileMachineAction object API](windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md) -####### [Get FileMachineActions collection API](windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) -####### [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md) -####### [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md) -####### [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md) -####### [Get MachineAction object API](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md) -####### [Get MachineActions collection API](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md) -####### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) -####### [Get package SAS URI API](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md) -####### [Isolate machine API](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md) -####### [Release machine from isolation API](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md) -####### [Remove app restriction API](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md) -####### [Request sample API](windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md) -####### [Restrict app execution API](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md) -####### [Run antivirus scan API](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md) -####### [Stop and quarantine file API](windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md) - - - -######User -####### [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md) -####### [Get user information](windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md) -####### [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md) -####### [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md) - - - - -#### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md) -##### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -##### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) -##### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md) -##### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md) -##### [Python code examples](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md) -##### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md) -##### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) - -#### [Reporting](reporting.md) -##### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) - -#### [Permissions](permissions.md) -##### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md) -##### [Create and manage machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md) - - - -### [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](integration.md) -#### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) - - - - - - - - - - - - - - - - - - - - - - -###Troubleshoot Windows Defender ATP -#### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) - -####Troubleshoot sensor state - Ask Heike name of sensor -##### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) -##### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) -##### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) -##### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) -##### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) - -#### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) -##### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) - - - - - - - - - - - - - - - - - - -## Other security features -### [The Windows Security app](windows-defender-security-center/windows-defender-security-center.md) -#### [Customize the Windows Security app for your organization](windows-defender-security-center/wdsc-customize-contact-information.md) -#### [Hide Windows Security app notifications](windows-defender-security-center/wdsc-hide-notifications.md) -#### [Manage Windows Security app in Windows 10 in S mode](windows-defender-security-center\wdsc-windows-10-in-s-mode.md) -#### [Virus and threat protection](windows-defender-security-center/wdsc-virus-threat-protection.md) -#### [Account protection](windows-defender-security-center\wdsc-account-protection.md) -#### [Firewall and network protection](windows-defender-security-center\wdsc-firewall-network-protection.md) -#### [App and browser control](windows-defender-security-center\wdsc-app-browser-control.md) -#### [Device security](windows-defender-security-center\wdsc-device-security.md) -#### [Device performance and health](windows-defender-security-center\wdsc-device-performance-health.md) -#### [Family options](windows-defender-security-center\wdsc-family-options.md) - - -### [Windows Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) -#### [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) -#### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) - - -### [Windows Defender Device Guard: virtualization-based security and WDAC](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) - - -### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) - -### [Mitigate threats by using Windows 10 security features](overview-of-threat-mitigations-in-windows-10.md) - -### [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) - -### [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-intrusion-detection.md) - -### [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) - -### [Security auditing](auditing/security-auditing-overview.md) - -#### [Basic security audit policies](auditing/basic-security-audit-policies.md) -##### [Create a basic audit policy for an event category](auditing/create-a-basic-audit-policy-settings-for-an-event-category.md) -##### [Apply a basic audit policy on a file or folder](auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md) -##### [View the security event log](auditing/view-the-security-event-log.md) - -##### [Basic security audit policy settings](auditing/basic-security-audit-policy-settings.md) -###### [Audit account logon events](auditing/basic-audit-account-logon-events.md) -###### [Audit account management](auditing/basic-audit-account-management.md) -###### [Audit directory service access](auditing/basic-audit-directory-service-access.md) -###### [Audit logon events](auditing/basic-audit-logon-events.md) -###### [Audit object access](auditing/basic-audit-object-access.md) -###### [Audit policy change](auditing/basic-audit-policy-change.md) -###### [Audit privilege use](auditing/basic-audit-privilege-use.md) -###### [Audit process tracking](auditing/basic-audit-process-tracking.md) -###### [Audit system events](auditing/basic-audit-system-events.md) - -##### [Advanced security audit policies](auditing/advanced-security-auditing.md) -###### [Planning and deploying advanced security audit policies](auditing/planning-and-deploying-advanced-security-audit-policies.md) -###### [Advanced security auditing FAQ](auditing/advanced-security-auditing-faq.md) -####### [Which editions of Windows support advanced audit policy configuration](auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md) - -###### [Using advanced security auditing options to monitor dynamic access control objects](auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) -####### [Monitor the central access policies that apply on a file server](auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md) -####### [Monitor the use of removable storage devices](auditing/monitor-the-use-of-removable-storage-devices.md) -####### [Monitor resource attribute definitions](auditing/monitor-resource-attribute-definitions.md) -####### [Monitor central access policy and rule definitions](auditing/monitor-central-access-policy-and-rule-definitions.md) -####### [Monitor user and device claims during sign-in](auditing/monitor-user-and-device-claims-during-sign-in.md) -####### [Monitor the resource attributes on files and folders](auditing/monitor-the-resource-attributes-on-files-and-folders.md) -####### [Monitor the central access policies associated with files and folders](auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md) -####### [Monitor claim types](auditing/monitor-claim-types.md) - -###### [Advanced security audit policy settings](auditing/advanced-security-audit-policy-settings.md) -####### [Audit Credential Validation](auditing/audit-credential-validation.md) -####### [Event 4774 S, F: An account was mapped for logon.](auditing/event-4774.md) -####### [Event 4775 F: An account could not be mapped for logon.](auditing/event-4775.md) -####### [Event 4776 S, F: The computer attempted to validate the credentials for an account.](auditing/event-4776.md) -####### [Event 4777 F: The domain controller failed to validate the credentials for an account.](auditing/event-4777.md) -###### [Audit Kerberos Authentication Service](auditing/audit-kerberos-authentication-service.md) -####### [Event 4768 S, F: A Kerberos authentication ticket, TGT, was requested.](auditing/event-4768.md) -####### [Event 4771 F: Kerberos pre-authentication failed.](auditing/event-4771.md) -####### [Event 4772 F: A Kerberos authentication ticket request failed.](auditing/event-4772.md) -###### [Audit Kerberos Service Ticket Operations](auditing/audit-kerberos-service-ticket-operations.md) -####### [Event 4769 S, F: A Kerberos service ticket was requested.](auditing/event-4769.md) -####### [Event 4770 S: A Kerberos service ticket was renewed.](auditing/event-4770.md) -####### [Event 4773 F: A Kerberos service ticket request failed.](auditing/event-4773.md) -###### [Audit Other Account Logon Events](auditing/audit-other-account-logon-events.md) -###### [Audit Application Group Management](auditing/audit-application-group-management.md) -###### [Audit Computer Account Management](auditing/audit-computer-account-management.md) -####### [Event 4741 S: A computer account was created.](auditing/event-4741.md) -####### [Event 4742 S: A computer account was changed.](auditing/event-4742.md) -####### [Event 4743 S: A computer account was deleted.](auditing/event-4743.md) -###### [Audit Distribution Group Management](auditing/audit-distribution-group-management.md) -####### [Event 4749 S: A security-disabled global group was created.](auditing/event-4749.md) -####### [Event 4750 S: A security-disabled global group was changed.](auditing/event-4750.md) -####### [Event 4751 S: A member was added to a security-disabled global group.](auditing/event-4751.md) -####### [Event 4752 S: A member was removed from a security-disabled global group.](auditing/event-4752.md) -####### [Event 4753 S: A security-disabled global group was deleted.](auditing/event-4753.md) -###### [Audit Other Account Management Events](auditing/audit-other-account-management-events.md) -####### [Event 4782 S: The password hash an account was accessed.](auditing/event-4782.md) -####### [Event 4793 S: The Password Policy Checking API was called.](auditing/event-4793.md) -###### [Audit Security Group Management](auditing/audit-security-group-management.md) -####### [Event 4731 S: A security-enabled local group was created.](auditing/event-4731.md) -####### [Event 4732 S: A member was added to a security-enabled local group.](auditing/event-4732.md) -####### [Event 4733 S: A member was removed from a security-enabled local group.](auditing/event-4733.md) -####### [Event 4734 S: A security-enabled local group was deleted.](auditing/event-4734.md) -####### [Event 4735 S: A security-enabled local group was changed.](auditing/event-4735.md) -####### [Event 4764 S: A group’s type was changed.](auditing/event-4764.md) -####### [Event 4799 S: A security-enabled local group membership was enumerated.](auditing/event-4799.md) -###### [Audit User Account Management](auditing/audit-user-account-management.md) -####### [Event 4720 S: A user account was created.](auditing/event-4720.md) -####### [Event 4722 S: A user account was enabled.](auditing/event-4722.md) -####### [Event 4723 S, F: An attempt was made to change an account's password.](auditing/event-4723.md) -####### [Event 4724 S, F: An attempt was made to reset an account's password.](auditing/event-4724.md) -####### [Event 4725 S: A user account was disabled.](auditing/event-4725.md) -####### [Event 4726 S: A user account was deleted.](auditing/event-4726.md) -####### [Event 4738 S: A user account was changed.](auditing/event-4738.md) -####### [Event 4740 S: A user account was locked out.](auditing/event-4740.md) -####### [Event 4765 S: SID History was added to an account.](auditing/event-4765.md) -####### [Event 4766 F: An attempt to add SID History to an account failed.](auditing/event-4766.md) -####### [Event 4767 S: A user account was unlocked.](auditing/event-4767.md) -####### [Event 4780 S: The ACL was set on accounts which are members of administrators groups.](auditing/event-4780.md) -####### [Event 4781 S: The name of an account was changed.](auditing/event-4781.md) -####### [Event 4794 S, F: An attempt was made to set the Directory Services Restore Mode administrator password.](auditing/event-4794.md) -####### [Event 4798 S: A user's local group membership was enumerated.](auditing/event-4798.md) -####### [Event 5376 S: Credential Manager credentials were backed up.](auditing/event-5376.md) -####### [Event 5377 S: Credential Manager credentials were restored from a backup.](auditing/event-5377.md) -###### [Audit DPAPI Activity](auditing/audit-dpapi-activity.md) -####### [Event 4692 S, F: Backup of data protection master key was attempted.](auditing/event-4692.md) -####### [Event 4693 S, F: Recovery of data protection master key was attempted.](auditing/event-4693.md) -####### [Event 4694 S, F: Protection of auditable protected data was attempted.](auditing/event-4694.md) -####### [Event 4695 S, F: Unprotection of auditable protected data was attempted.](auditing/event-4695.md) -###### [Audit PNP Activity](auditing/audit-pnp-activity.md) -####### [Event 6416 S: A new external device was recognized by the System.](auditing/event-6416.md) -####### [Event 6419 S: A request was made to disable a device.](auditing/event-6419.md) -####### [Event 6420 S: A device was disabled.](auditing/event-6420.md) -####### [Event 6421 S: A request was made to enable a device.](auditing/event-6421.md) -####### [Event 6422 S: A device was enabled.](auditing/event-6422.md) -####### [Event 6423 S: The installation of this device is forbidden by system policy.](auditing/event-6423.md) -####### [Event 6424 S: The installation of this device was allowed, after having previously been forbidden by policy.](auditing/event-6424.md) -###### [Audit Process Creation](auditing/audit-process-creation.md) -####### [Event 4688 S: A new process has been created.](auditing/event-4688.md) -####### [Event 4696 S: A primary token was assigned to process.](auditing/event-4696.md) -###### [Audit Process Termination](auditing/audit-process-termination.md) -####### [Event 4689 S: A process has exited.](auditing/event-4689.md) -###### [Audit RPC Events](auditing/audit-rpc-events.md) -####### [Event 5712 S: A Remote Procedure Call, RPC, was attempted.](auditing/event-5712.md) -###### [Audit Detailed Directory Service Replication](auditing/audit-detailed-directory-service-replication.md) -####### [Event 4928 S, F: An Active Directory replica source naming context was established.](auditing/event-4928.md) -####### [Event 4929 S, F: An Active Directory replica source naming context was removed.](auditing/event-4929.md) -####### [Event 4930 S, F: An Active Directory replica source naming context was modified.](auditing/event-4930.md) -####### [Event 4931 S, F: An Active Directory replica destination naming context was modified.](auditing/event-4931.md) -####### [Event 4934 S: Attributes of an Active Directory object were replicated.](auditing/event-4934.md) -####### [Event 4935 F: Replication failure begins.](auditing/event-4935.md) -####### [Event 4936 S: Replication failure ends.](auditing/event-4936.md) -####### [Event 4937 S: A lingering object was removed from a replica.](auditing/event-4937.md) -###### [Audit Directory Service Access](auditing/audit-directory-service-access.md) -####### [Event 4662 S, F: An operation was performed on an object.](auditing/event-4662.md) -####### [Event 4661 S, F: A handle to an object was requested.](auditing/event-4661.md) -###### [Audit Directory Service Changes](auditing/audit-directory-service-changes.md) -####### [Event 5136 S: A directory service object was modified.](auditing/event-5136.md) -####### [Event 5137 S: A directory service object was created.](auditing/event-5137.md) -####### [Event 5138 S: A directory service object was undeleted.](auditing/event-5138.md) -####### [Event 5139 S: A directory service object was moved.](auditing/event-5139.md) -####### [Event 5141 S: A directory service object was deleted.](auditing/event-5141.md) -###### [Audit Directory Service Replication](auditing/audit-directory-service-replication.md) -####### [Event 4932 S: Synchronization of a replica of an Active Directory naming context has begun.](auditing/event-4932.md) -####### [Event 4933 S, F: Synchronization of a replica of an Active Directory naming context has ended.](auditing/event-4933.md) -###### [Audit Account Lockout](auditing/audit-account-lockout.md) -####### [Event 4625 F: An account failed to log on.](auditing/event-4625.md) -###### [Audit User/Device Claims](auditing/audit-user-device-claims.md) -####### [Event 4626 S: User/Device claims information.](auditing/event-4626.md) -###### [Audit Group Membership](auditing/audit-group-membership.md) -####### [Event 4627 S: Group membership information.](auditing/event-4627.md) -###### [Audit IPsec Extended Mode](auditing/audit-ipsec-extended-mode.md) -###### [Audit IPsec Main Mode](auditing/audit-ipsec-main-mode.md) -###### [Audit IPsec Quick Mode](auditing/audit-ipsec-quick-mode.md) -###### [Audit Logoff](auditing/audit-logoff.md) -####### [Event 4634 S: An account was logged off.](auditing/event-4634.md) -####### [Event 4647 S: User initiated logoff.](auditing/event-4647.md) -###### [Audit Logon](auditing/audit-logon.md) -####### [Event 4624 S: An account was successfully logged on.](auditing/event-4624.md) -####### [Event 4625 F: An account failed to log on.](auditing/event-4625.md) -####### [Event 4648 S: A logon was attempted using explicit credentials.](auditing/event-4648.md) -####### [Event 4675 S: SIDs were filtered.](auditing/event-4675.md) -###### [Audit Network Policy Server](auditing/audit-network-policy-server.md) -###### [Audit Other Logon/Logoff Events](auditing/audit-other-logonlogoff-events.md) -####### [Event 4649 S: A replay attack was detected.](auditing/event-4649.md) -####### [Event 4778 S: A session was reconnected to a Window Station.](auditing/event-4778.md) -####### [Event 4779 S: A session was disconnected from a Window Station.](auditing/event-4779.md) -####### [Event 4800 S: The workstation was locked.](auditing/event-4800.md) -####### [Event 4801 S: The workstation was unlocked.](auditing/event-4801.md) -####### [Event 4802 S: The screen saver was invoked.](auditing/event-4802.md) -####### [Event 4803 S: The screen saver was dismissed.](auditing/event-4803.md) -####### [Event 5378 F: The requested credentials delegation was disallowed by policy.](auditing/event-5378.md) -####### [Event 5632 S, F: A request was made to authenticate to a wireless network.](auditing/event-5632.md) -####### [Event 5633 S, F: A request was made to authenticate to a wired network.](auditing/event-5633.md) -###### [Audit Special Logon](auditing/audit-special-logon.md) -####### [Event 4964 S: Special groups have been assigned to a new logon.](auditing/event-4964.md) -####### [Event 4672 S: Special privileges assigned to new logon.](auditing/event-4672.md) -###### [Audit Application Generated](auditing/audit-application-generated.md) -###### [Audit Certification Services](auditing/audit-certification-services.md) -###### [Audit Detailed File Share](auditing/audit-detailed-file-share.md) -####### [Event 5145 S, F: A network share object was checked to see whether client can be granted desired access.](auditing/event-5145.md) -###### [Audit File Share](auditing/audit-file-share.md) -####### [Event 5140 S, F: A network share object was accessed.](auditing/event-5140.md) -####### [Event 5142 S: A network share object was added.](auditing/event-5142.md) -####### [Event 5143 S: A network share object was modified.](auditing/event-5143.md) -####### [Event 5144 S: A network share object was deleted.](auditing/event-5144.md) -####### [Event 5168 F: SPN check for SMB/SMB2 failed.](auditing/event-5168.md) -###### [Audit File System](auditing/audit-file-system.md) -####### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) -####### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) -####### [Event 4660 S: An object was deleted.](auditing/event-4660.md) -####### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) -####### [Event 4664 S: An attempt was made to create a hard link.](auditing/event-4664.md) -####### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) -####### [Event 5051: A file was virtualized.](auditing/event-5051.md) -####### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) -###### [Audit Filtering Platform Connection](auditing/audit-filtering-platform-connection.md) -####### [Event 5031 F: The Windows Firewall Service blocked an application from accepting incoming connections on the network.](auditing/event-5031.md) -####### [Event 5150: The Windows Filtering Platform blocked a packet.](auditing/event-5150.md) -####### [Event 5151: A more restrictive Windows Filtering Platform filter has blocked a packet.](auditing/event-5151.md) -####### [Event 5154 S: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.](auditing/event-5154.md) -####### [Event 5155 F: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.](auditing/event-5155.md) -####### [Event 5156 S: The Windows Filtering Platform has permitted a connection.](auditing/event-5156.md) -####### [Event 5157 F: The Windows Filtering Platform has blocked a connection.](auditing/event-5157.md) -####### [Event 5158 S: The Windows Filtering Platform has permitted a bind to a local port.](auditing/event-5158.md) -####### [Event 5159 F: The Windows Filtering Platform has blocked a bind to a local port.](auditing/event-5159.md) -###### [Audit Filtering Platform Packet Drop](auditing/audit-filtering-platform-packet-drop.md) -####### [Event 5152 F: The Windows Filtering Platform blocked a packet.](auditing/event-5152.md) -####### [Event 5153 S: A more restrictive Windows Filtering Platform filter has blocked a packet.](auditing/event-5153.md) -###### [Audit Handle Manipulation](auditing/audit-handle-manipulation.md) -####### [Event 4690 S: An attempt was made to duplicate a handle to an object.](auditing/event-4690.md) -###### [Audit Kernel Object](auditing/audit-kernel-object.md) -####### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) -####### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) -####### [Event 4660 S: An object was deleted.](auditing/event-4660.md) -####### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) -###### [Audit Other Object Access Events](auditing/audit-other-object-access-events.md) -####### [Event 4671: An application attempted to access a blocked ordinal through the TBS.](auditing/event-4671.md) -####### [Event 4691 S: Indirect access to an object was requested.](auditing/event-4691.md) -####### [Event 5148 F: The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.](auditing/event-5148.md) -####### [Event 5149 F: The DoS attack has subsided and normal processing is being resumed.](auditing/event-5149.md) -####### [Event 4698 S: A scheduled task was created.](auditing/event-4698.md) -####### [Event 4699 S: A scheduled task was deleted.](auditing/event-4699.md) -####### [Event 4700 S: A scheduled task was enabled.](auditing/event-4700.md) -####### [Event 4701 S: A scheduled task was disabled.](auditing/event-4701.md) -####### [Event 4702 S: A scheduled task was updated.](auditing/event-4702.md) -####### [Event 5888 S: An object in the COM+ Catalog was modified.](auditing/event-5888.md) -####### [Event 5889 S: An object was deleted from the COM+ Catalog.](auditing/event-5889.md) -####### [Event 5890 S: An object was added to the COM+ Catalog.](auditing/event-5890.md) -###### [Audit Registry](auditing/audit-registry.md) -####### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) -####### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) -####### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) -####### [Event 4660 S: An object was deleted.](auditing/event-4660.md) -####### [Event 4657 S: A registry value was modified.](auditing/event-4657.md) -####### [Event 5039: A registry key was virtualized.](auditing/event-5039.md) -####### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) -###### [Audit Removable Storage](auditing/audit-removable-storage.md) -###### [Audit SAM](auditing/audit-sam.md) -####### [Event 4661 S, F: A handle to an object was requested.](auditing/event-4661.md) -###### [Audit Central Access Policy Staging](auditing/audit-central-access-policy-staging.md) -####### [Event 4818 S: Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy.](auditing/event-4818.md) -###### [Audit Audit Policy Change](auditing/audit-audit-policy-change.md) -####### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) -####### [Event 4715 S: The audit policy, SACL, on an object was changed.](auditing/event-4715.md) -####### [Event 4719 S: System audit policy was changed.](auditing/event-4719.md) -####### [Event 4817 S: Auditing settings on object were changed.](auditing/event-4817.md) -####### [Event 4902 S: The Per-user audit policy table was created.](auditing/event-4902.md) -####### [Event 4906 S: The CrashOnAuditFail value has changed.](auditing/event-4906.md) -####### [Event 4907 S: Auditing settings on object were changed.](auditing/event-4907.md) -####### [Event 4908 S: Special Groups Logon table modified.](auditing/event-4908.md) -####### [Event 4912 S: Per User Audit Policy was changed.](auditing/event-4912.md) -####### [Event 4904 S: An attempt was made to register a security event source.](auditing/event-4904.md) -####### [Event 4905 S: An attempt was made to unregister a security event source.](auditing/event-4905.md) -###### [Audit Authentication Policy Change](auditing/audit-authentication-policy-change.md) -####### [Event 4706 S: A new trust was created to a domain.](auditing/event-4706.md) -####### [Event 4707 S: A trust to a domain was removed.](auditing/event-4707.md) -####### [Event 4716 S: Trusted domain information was modified.](auditing/event-4716.md) -####### [Event 4713 S: Kerberos policy was changed.](auditing/event-4713.md) -####### [Event 4717 S: System security access was granted to an account.](auditing/event-4717.md) -####### [Event 4718 S: System security access was removed from an account.](auditing/event-4718.md) -####### [Event 4739 S: Domain Policy was changed.](auditing/event-4739.md) -####### [Event 4864 S: A namespace collision was detected.](auditing/event-4864.md) -####### [Event 4865 S: A trusted forest information entry was added.](auditing/event-4865.md) -####### [Event 4866 S: A trusted forest information entry was removed.](auditing/event-4866.md) -####### [Event 4867 S: A trusted forest information entry was modified.](auditing/event-4867.md) -###### [Audit Authorization Policy Change](auditing/audit-authorization-policy-change.md) -####### [Event 4703 S: A user right was adjusted.](auditing/event-4703.md) -####### [Event 4704 S: A user right was assigned.](auditing/event-4704.md) -####### [Event 4705 S: A user right was removed.](auditing/event-4705.md) -####### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) -####### [Event 4911 S: Resource attributes of the object were changed.](auditing/event-4911.md) -####### [Event 4913 S: Central Access Policy on the object was changed.](auditing/event-4913.md) -###### [Audit Filtering Platform Policy Change](auditing/audit-filtering-platform-policy-change.md) -###### [Audit MPSSVC Rule-Level Policy Change](auditing/audit-mpssvc-rule-level-policy-change.md) -####### [Event 4944 S: The following policy was active when the Windows Firewall started.](auditing/event-4944.md) -####### [Event 4945 S: A rule was listed when the Windows Firewall started.](auditing/event-4945.md) -####### [Event 4946 S: A change has been made to Windows Firewall exception list. A rule was added.](auditing/event-4946.md) -####### [Event 4947 S: A change has been made to Windows Firewall exception list. A rule was modified.](auditing/event-4947.md) -####### [Event 4948 S: A change has been made to Windows Firewall exception list. A rule was deleted.](auditing/event-4948.md) -####### [Event 4949 S: Windows Firewall settings were restored to the default values.](auditing/event-4949.md) -####### [Event 4950 S: A Windows Firewall setting has changed.](auditing/event-4950.md) -####### [Event 4951 F: A rule has been ignored because its major version number was not recognized by Windows Firewall.](auditing/event-4951.md) -####### [Event 4952 F: Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.](auditing/event-4952.md) -####### [Event 4953 F: Windows Firewall ignored a rule because it could not be parsed.](auditing/event-4953.md) -####### [Event 4954 S: Windows Firewall Group Policy settings have changed. The new settings have been applied.](auditing/event-4954.md) -####### [Event 4956 S: Windows Firewall has changed the active profile.](auditing/event-4956.md) -####### [Event 4957 F: Windows Firewall did not apply the following rule.](auditing/event-4957.md) -####### [Event 4958 F: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.](auditing/event-4958.md) -###### [Audit Other Policy Change Events](auditing/audit-other-policy-change-events.md) -####### [Event 4714 S: Encrypted data recovery policy was changed.](auditing/event-4714.md) -####### [Event 4819 S: Central Access Policies on the machine have been changed.](auditing/event-4819.md) -####### [Event 4826 S: Boot Configuration Data loaded.](auditing/event-4826.md) -####### [Event 4909: The local policy settings for the TBS were changed.](auditing/event-4909.md) -####### [Event 4910: The group policy settings for the TBS were changed.](auditing/event-4910.md) -####### [Event 5063 S, F: A cryptographic provider operation was attempted.](auditing/event-5063.md) -####### [Event 5064 S, F: A cryptographic context operation was attempted.](auditing/event-5064.md) -####### [Event 5065 S, F: A cryptographic context modification was attempted.](auditing/event-5065.md) -####### [Event 5066 S, F: A cryptographic function operation was attempted.](auditing/event-5066.md) -####### [Event 5067 S, F: A cryptographic function modification was attempted.](auditing/event-5067.md) -####### [Event 5068 S, F: A cryptographic function provider operation was attempted.](auditing/event-5068.md) -####### [Event 5069 S, F: A cryptographic function property operation was attempted.](auditing/event-5069.md) -####### [Event 5070 S, F: A cryptographic function property modification was attempted.](auditing/event-5070.md) -####### [Event 5447 S: A Windows Filtering Platform filter has been changed.](auditing/event-5447.md) -####### [Event 6144 S: Security policy in the group policy objects has been applied successfully.](auditing/event-6144.md) -####### [Event 6145 F: One or more errors occurred while processing security policy in the group policy objects.](auditing/event-6145.md) -###### [Audit Sensitive Privilege Use](auditing/audit-sensitive-privilege-use.md) -####### [Event 4673 S, F: A privileged service was called.](auditing/event-4673.md) -####### [Event 4674 S, F: An operation was attempted on a privileged object.](auditing/event-4674.md) -####### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) -###### [Audit Non Sensitive Privilege Use](auditing/audit-non-sensitive-privilege-use.md) -####### [Event 4673 S, F: A privileged service was called.](auditing/event-4673.md) -####### [Event 4674 S, F: An operation was attempted on a privileged object.](auditing/event-4674.md) -####### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) -###### [Audit Other Privilege Use Events](auditing/audit-other-privilege-use-events.md) -####### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) -###### [Audit IPsec Driver](auditing/audit-ipsec-driver.md) -###### [Audit Other System Events](auditing/audit-other-system-events.md) -####### [Event 5024 S: The Windows Firewall Service has started successfully.](auditing/event-5024.md) -####### [Event 5025 S: The Windows Firewall Service has been stopped.](auditing/event-5025.md) -####### [Event 5027 F: The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.](auditing/event-5027.md) -####### [Event 5028 F: The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.](auditing/event-5028.md) -####### [Event 5029 F: The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.](auditing/event-5029.md) -####### [Event 5030 F: The Windows Firewall Service failed to start.](auditing/event-5030.md) -####### [Event 5032 F: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.](auditing/event-5032.md) -####### [Event 5033 S: The Windows Firewall Driver has started successfully.](auditing/event-5033.md) -####### [Event 5034 S: The Windows Firewall Driver was stopped.](auditing/event-5034.md) -####### [Event 5035 F: The Windows Firewall Driver failed to start.](auditing/event-5035.md) -####### [Event 5037 F: The Windows Firewall Driver detected critical runtime error. Terminating.](auditing/event-5037.md) -####### [Event 5058 S, F: Key file operation.](auditing/event-5058.md) -####### [Event 5059 S, F: Key migration operation.](auditing/event-5059.md) -####### [Event 6400: BranchCache: Received an incorrectly formatted response while discovering availability of content.](auditing/event-6400.md) -####### [Event 6401: BranchCache: Received invalid data from a peer. Data discarded.](auditing/event-6401.md) -####### [Event 6402: BranchCache: The message to the hosted cache offering it data is incorrectly formatted.](auditing/event-6402.md) -####### [Event 6403: BranchCache: The hosted cache sent an incorrectly formatted response to the client.](auditing/event-6403.md) -####### [Event 6404: BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.](auditing/event-6404.md) -####### [Event 6405: BranchCache: %2 instances of event id %1 occurred.](auditing/event-6405.md) -####### [Event 6406: %1 registered to Windows Firewall to control filtering for the following: %2.](auditing/event-6406.md) -####### [Event 6407: 1%.](auditing/event-6407.md) -####### [Event 6408: Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.](auditing/event-6408.md) -####### [Event 6409: BranchCache: A service connection point object could not be parsed.](auditing/event-6409.md) -###### [Audit Security State Change](auditing/audit-security-state-change.md) -####### [Event 4608 S: Windows is starting up.](auditing/event-4608.md) -####### [Event 4616 S: The system time was changed.](auditing/event-4616.md) -####### [Event 4621 S: Administrator recovered system from CrashOnAuditFail.](auditing/event-4621.md) -###### [Audit Security System Extension](auditing/audit-security-system-extension.md) -####### [Event 4610 S: An authentication package has been loaded by the Local Security Authority.](auditing/event-4610.md) -####### [Event 4611 S: A trusted logon process has been registered with the Local Security Authority.](auditing/event-4611.md) -####### [Event 4614 S: A notification package has been loaded by the Security Account Manager.](auditing/event-4614.md) -####### [Event 4622 S: A security package has been loaded by the Local Security Authority.](auditing/event-4622.md) -####### [Event 4697 S: A service was installed in the system.](auditing/event-4697.md) -###### [Audit System Integrity](auditing/audit-system-integrity.md) -####### [Event 4612 S: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.](auditing/event-4612.md) -####### [Event 4615 S: Invalid use of LPC port.](auditing/event-4615.md) -####### [Event 4618 S: A monitored security event pattern has occurred.](auditing/event-4618.md) -####### [Event 4816 S: RPC detected an integrity violation while decrypting an incoming message.](auditing/event-4816.md) -####### [Event 5038 F: Code integrity determined that the image hash of a file is not valid.](auditing/event-5038.md) -####### [Event 5056 S: A cryptographic self-test was performed.](auditing/event-5056.md) -####### [Event 5062 S: A kernel-mode cryptographic self-test was performed.](auditing/event-5062.md) -####### [Event 5057 F: A cryptographic primitive operation failed.](auditing/event-5057.md) -####### [Event 5060 F: Verification operation failed.](auditing/event-5060.md) -####### [Event 5061 S, F: Cryptographic operation.](auditing/event-5061.md) -####### [Event 6281 F: Code Integrity determined that the page hashes of an image file are not valid.](auditing/event-6281.md) -####### [Event 6410 F: Code integrity determined that a file does not meet the security requirements to load into a process.](auditing/event-6410.md) -###### [Other Events](auditing/other-events.md) -####### [Event 1100 S: The event logging service has shut down.](auditing/event-1100.md) -####### [Event 1102 S: The audit log was cleared.](auditing/event-1102.md) -####### [Event 1104 S: The security log is now full.](auditing/event-1104.md) -####### [Event 1105 S: Event log automatic backup.](auditing/event-1105.md) -####### [Event 1108 S: The event logging service encountered an error while processing an incoming event published from %1.](auditing/event-1108.md) -###### [Appendix A: Security monitoring recommendations for many audit events](auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md) -###### [Registry (Global Object Access Auditing) ](auditing/registry-global-object-access-auditing.md) -###### [File System (Global Object Access Auditing) ](auditing/file-system-global-object-access-auditing.md) +# [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) - - - - -#### [Security policy settings](security-policy-settings/security-policy-settings.md) -#### [Administer security policy settings](security-policy-settings/administer-security-policy-settings.md) -##### [Network List Manager policies](security-policy-settings/network-list-manager-policies.md) -#### [Configure security policy settings](security-policy-settings/how-to-configure-security-policy-settings.md) -#### [Security policy settings reference](security-policy-settings/security-policy-settings-reference.md) -##### [Account Policies](security-policy-settings/account-policies.md) -###### [Password Policy](security-policy-settings/password-policy.md) -####### [Enforce password history](security-policy-settings/enforce-password-history.md) -####### [Maximum password age](security-policy-settings/maximum-password-age.md) -####### [Minimum password age](security-policy-settings/minimum-password-age.md) -####### [Minimum password length](security-policy-settings/minimum-password-length.md) -####### [Password must meet complexity requirements](security-policy-settings/password-must-meet-complexity-requirements.md) -####### [Store passwords using reversible encryption](security-policy-settings/store-passwords-using-reversible-encryption.md) -###### [Account Lockout Policy](security-policy-settings/account-lockout-policy.md) -####### [Account lockout duration](security-policy-settings/account-lockout-duration.md) -####### [Account lockout threshold](security-policy-settings/account-lockout-threshold.md) -####### [Reset account lockout counter after](security-policy-settings/reset-account-lockout-counter-after.md) -###### [Kerberos Policy](security-policy-settings/kerberos-policy.md) -####### [Enforce user logon restrictions](security-policy-settings/enforce-user-logon-restrictions.md) -####### [Maximum lifetime for service ticket](security-policy-settings/maximum-lifetime-for-service-ticket.md) -####### [Maximum lifetime for user ticket](security-policy-settings/maximum-lifetime-for-user-ticket.md) -####### [Maximum lifetime for user ticket renewal](security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md) -####### [Maximum tolerance for computer clock synchronization](security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md) -##### [Audit Policy](security-policy-settings/audit-policy.md) -##### [Security Options](security-policy-settings/security-options.md) -###### [Accounts: Administrator account status](security-policy-settings/accounts-administrator-account-status.md) -###### [Accounts: Block Microsoft accounts](security-policy-settings/accounts-block-microsoft-accounts.md) -###### [Accounts: Guest account status](security-policy-settings/accounts-guest-account-status.md) -###### [Accounts: Limit local account use of blank passwords to console logon only](security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md) -###### [Accounts: Rename administrator account](security-policy-settings/accounts-rename-administrator-account.md) -###### [Accounts: Rename guest account](security-policy-settings/accounts-rename-guest-account.md) -###### [Audit: Audit the access of global system objects](security-policy-settings/audit-audit-the-access-of-global-system-objects.md) -###### [Audit: Audit the use of Backup and Restore privilege](security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md) -###### [Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings](security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md) -###### [Audit: Shut down system immediately if unable to log security audits](security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md) -###### [DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax](security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md) -###### [DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax](security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md) -###### [Devices: Allow undock without having to log on](security-policy-settings/devices-allow-undock-without-having-to-log-on.md) -###### [Devices: Allowed to format and eject removable media](security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md) -###### [Devices: Prevent users from installing printer drivers](security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md) -###### [Devices: Restrict CD-ROM access to locally logged-on user only](security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md) -###### [Devices: Restrict floppy access to locally logged-on user only](security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md) -###### [Domain controller: Allow server operators to schedule tasks](security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md) -###### [Domain controller: LDAP server signing requirements](security-policy-settings/domain-controller-ldap-server-signing-requirements.md) -###### [Domain controller: Refuse machine account password changes](security-policy-settings/domain-controller-refuse-machine-account-password-changes.md) -###### [Domain member: Digitally encrypt or sign secure channel data (always)](security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) -###### [Domain member: Digitally encrypt secure channel data (when possible)](security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md) -###### [Domain member: Digitally sign secure channel data (when possible)](security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md) -###### [Domain member: Disable machine account password changes](security-policy-settings/domain-member-disable-machine-account-password-changes.md) -###### [Domain member: Maximum machine account password age](security-policy-settings/domain-member-maximum-machine-account-password-age.md) -###### [Domain member: Require strong (Windows 2000 or later) session key](security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md) -###### [Interactive logon: Display user information when the session is locked](security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md) -###### [Interactive logon: Don't display last signed-in](security-policy-settings/interactive-logon-do-not-display-last-user-name.md) -###### [Interactive logon: Don't display username at sign-in](security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md) -###### [Interactive logon: Do not require CTRL+ALT+DEL](security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md) -###### [Interactive logon: Machine account lockout threshold](security-policy-settings/interactive-logon-machine-account-lockout-threshold.md) -###### [Interactive logon: Machine inactivity limit](security-policy-settings/interactive-logon-machine-inactivity-limit.md) -###### [Interactive logon: Message text for users attempting to log on](security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md) -###### [Interactive logon: Message title for users attempting to log on](security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md) -###### [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) -###### [Interactive logon: Prompt user to change password before expiration](security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md) -###### [Interactive logon: Require Domain Controller authentication to unlock workstation](security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md) -###### [Interactive logon: Require smart card](security-policy-settings/interactive-logon-require-smart-card.md) -###### [Interactive logon: Smart card removal behavior](security-policy-settings/interactive-logon-smart-card-removal-behavior.md) -###### [Microsoft network client: Digitally sign communications (always)](security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md) -###### [SMBv1 Microsoft network client: Digitally sign communications (always)](security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-always.md) -###### [SMBv1 Microsoft network client: Digitally sign communications (if server agrees)](security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees.md) -###### [Microsoft network client: Send unencrypted password to third-party SMB servers](security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md) -###### [Microsoft network server: Amount of idle time required before suspending session](security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md) -###### [Microsoft network server: Attempt S4U2Self to obtain claim information](security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md) -###### [Microsoft network server: Digitally sign communications (always)](security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md) -###### [SMBv1 Microsoft network server: Digitally sign communications (always)](security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md) -###### [SMBv1 Microsoft network server: Digitally sign communications (if client agrees)](security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md) -###### [Microsoft network server: Disconnect clients when logon hours expire](security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md) -###### [Microsoft network server: Server SPN target name validation level](security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md) -###### [Network access: Allow anonymous SID/Name translation](security-policy-settings/network-access-allow-anonymous-sidname-translation.md) -###### [Network access: Do not allow anonymous enumeration of SAM accounts](security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md) -###### [Network access: Do not allow anonymous enumeration of SAM accounts and shares](security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md) -###### [Network access: Do not allow storage of passwords and credentials for network authentication](security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md) -###### [Network access: Let Everyone permissions apply to anonymous users](security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md) -###### [Network access: Named Pipes that can be accessed anonymously](security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md) -###### [Network access: Remotely accessible registry paths](security-policy-settings/network-access-remotely-accessible-registry-paths.md) -###### [Network access: Remotely accessible registry paths and subpaths](security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md) -###### [Network access: Restrict anonymous access to Named Pipes and Shares](security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md) -###### [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md) -###### [Network access: Shares that can be accessed anonymously](security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md) -###### [Network access: Sharing and security model for local accounts](security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md) -###### [Network security: Allow Local System to use computer identity for NTLM](security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) -###### [Network security: Allow LocalSystem NULL session fallback](security-policy-settings/network-security-allow-localsystem-null-session-fallback.md) -###### [Network security: Allow PKU2U authentication requests to this computer to use online identities](security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md) -###### [Network security: Configure encryption types allowed for Kerberos Win7 only](security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md) -###### [Network security: Do not store LAN Manager hash value on next password change](security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md) -###### [Network security: Force logoff when logon hours expire](security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md) -###### [Network security: LAN Manager authentication level](security-policy-settings/network-security-lan-manager-authentication-level.md) -###### [Network security: LDAP client signing requirements](security-policy-settings/network-security-ldap-client-signing-requirements.md) -###### [Network security: Minimum session security for NTLM SSP based (including secure RPC) clients](security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md) -###### [Network security: Minimum session security for NTLM SSP based (including secure RPC) servers](security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md) -###### [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md) -###### [Network security: Restrict NTLM: Add server exceptions in this domain](security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md) -###### [Network security: Restrict NTLM: Audit incoming NTLM traffic](security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md) -###### [Network security: Restrict NTLM: Audit NTLM authentication in this domain](security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md) -###### [Network security: Restrict NTLM: Incoming NTLM traffic](security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md) -###### [Network security: Restrict NTLM: NTLM authentication in this domain](security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md) -###### [Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) -###### [Recovery console: Allow automatic administrative logon](security-policy-settings/recovery-console-allow-automatic-administrative-logon.md) -###### [Recovery console: Allow floppy copy and access to all drives and folders](security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md) -###### [Shutdown: Allow system to be shut down without having to log on](security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md) -###### [Shutdown: Clear virtual memory pagefile](security-policy-settings/shutdown-clear-virtual-memory-pagefile.md) -###### [System cryptography: Force strong key protection for user keys stored on the computer](security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md) -###### [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md) -###### [System objects: Require case insensitivity for non-Windows subsystems](security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md) -###### [System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)](security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md) -###### [System settings: Optional subsystems](security-policy-settings/system-settings-optional-subsystems.md) -###### [System settings: Use certificate rules on Windows executables for Software Restriction Policies](security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md) -###### [User Account Control: Admin Approval Mode for the Built-in Administrator account](security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md) -###### [User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop](security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md) -###### [User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode](security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md) -###### [User Account Control: Behavior of the elevation prompt for standard users](security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md) -###### [User Account Control: Detect application installations and prompt for elevation](security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md) -###### [User Account Control: Only elevate executables that are signed and validated](security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md) -###### [User Account Control: Only elevate UIAccess applications that are installed in secure locations](security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md) -###### [User Account Control: Run all administrators in Admin Approval Mode](security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md) -###### [User Account Control: Switch to the secure desktop when prompting for elevation](security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md) -###### [User Account Control: Virtualize file and registry write failures to per-user locations](security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md) -##### [Advanced security audit policy settings](security-policy-settings/secpol-advanced-security-audit-policy-settings.md) -##### [User Rights Assignment](security-policy-settings/user-rights-assignment.md) -###### [Access Credential Manager as a trusted caller](security-policy-settings/access-credential-manager-as-a-trusted-caller.md) -###### [Access this computer from the network](security-policy-settings/access-this-computer-from-the-network.md) -###### [Act as part of the operating system](security-policy-settings/act-as-part-of-the-operating-system.md) -###### [Add workstations to domain](security-policy-settings/add-workstations-to-domain.md) -###### [Adjust memory quotas for a process](security-policy-settings/adjust-memory-quotas-for-a-process.md) -###### [Allow log on locally](security-policy-settings/allow-log-on-locally.md) -###### [Allow log on through Remote Desktop Services](security-policy-settings/allow-log-on-through-remote-desktop-services.md) -###### [Back up files and directories](security-policy-settings/back-up-files-and-directories.md) -###### [Bypass traverse checking](security-policy-settings/bypass-traverse-checking.md) -###### [Change the system time](security-policy-settings/change-the-system-time.md) -###### [Change the time zone](security-policy-settings/change-the-time-zone.md) -###### [Create a pagefile](security-policy-settings/create-a-pagefile.md) -###### [Create a token object](security-policy-settings/create-a-token-object.md) -###### [Create global objects](security-policy-settings/create-global-objects.md) -###### [Create permanent shared objects](security-policy-settings/create-permanent-shared-objects.md) -###### [Create symbolic links](security-policy-settings/create-symbolic-links.md) -###### [Debug programs](security-policy-settings/debug-programs.md) -###### [Deny access to this computer from the network](security-policy-settings/deny-access-to-this-computer-from-the-network.md) -###### [Deny log on as a batch job](security-policy-settings/deny-log-on-as-a-batch-job.md) -###### [Deny log on as a service](security-policy-settings/deny-log-on-as-a-service.md) -###### [Deny log on locally](security-policy-settings/deny-log-on-locally.md) -###### [Deny log on through Remote Desktop Services](security-policy-settings/deny-log-on-through-remote-desktop-services.md) -###### [Enable computer and user accounts to be trusted for delegation](security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md) -###### [Force shutdown from a remote system](security-policy-settings/force-shutdown-from-a-remote-system.md) -###### [Generate security audits](security-policy-settings/generate-security-audits.md) -###### [Impersonate a client after authentication](security-policy-settings/impersonate-a-client-after-authentication.md) -###### [Increase a process working set](security-policy-settings/increase-a-process-working-set.md) -###### [Increase scheduling priority](security-policy-settings/increase-scheduling-priority.md) -###### [Load and unload device drivers](security-policy-settings/load-and-unload-device-drivers.md) -###### [Lock pages in memory](security-policy-settings/lock-pages-in-memory.md) -###### [Log on as a batch job](security-policy-settings/log-on-as-a-batch-job.md) -###### [Log on as a service](security-policy-settings/log-on-as-a-service.md) -###### [Manage auditing and security log](security-policy-settings/manage-auditing-and-security-log.md) -###### [Modify an object label](security-policy-settings/modify-an-object-label.md) -###### [Modify firmware environment values](security-policy-settings/modify-firmware-environment-values.md) -###### [Perform volume maintenance tasks](security-policy-settings/perform-volume-maintenance-tasks.md) -###### [Profile single process](security-policy-settings/profile-single-process.md) -###### [Profile system performance](security-policy-settings/profile-system-performance.md) -###### [Remove computer from docking station](security-policy-settings/remove-computer-from-docking-station.md) -###### [Replace a process level token](security-policy-settings/replace-a-process-level-token.md) -###### [Restore files and directories](security-policy-settings/restore-files-and-directories.md) -###### [Shut down the system](security-policy-settings/shut-down-the-system.md) -###### [Synchronize directory service data](security-policy-settings/synchronize-directory-service-data.md) -###### [Take ownership of files or other objects](security-policy-settings/take-ownership-of-files-or-other-objects.md) +## [Get started](fake2.md) +### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) +### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) +### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) +### [Preview features](preview-windows-defender-advanced-threat-protection.md) +### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) +### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) + +### [Evaluate Windows Defender ATP](threat-protection/evaluate.md) +#### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) +#### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) +#### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) +#### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) +#### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) +#### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) +#### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) +#### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) + + +## [Onboard and configure machines to Windows Defender ATP](threat-protection/onboard.md) +### [Onboard machines - need to revise this page](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) +#### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md) +#### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md) +##### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md) +##### [Onboard machines using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) +##### [Onboard machines using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) +##### [Onboard machines using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md) +##### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) +#### [Onboard servers](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md) +#### [Onboard non-Windows machines](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) +#### [Run a detection test on a newly onboarded machine](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md) +#### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) +#### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) + + +###[Configure ASR](configure1.md) +#### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) +#### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) +#### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) + + +### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) +#### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) +#### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) +##### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) + + +#### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) +##### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) +###### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) +##### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) +###### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) +##### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) +###### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) +###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) +###### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) +###### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) +###### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) + + +#### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) +##### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md) +###### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) +##### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) +##### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md) +##### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md) +##### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md) +##### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) +##### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) +#### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) +#### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) +##### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) +##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) +##### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) +##### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) +##### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) + + + +### [Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) + + + +### [Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) +####General +##### [Update data retention settings](windows-defender-atp\data-retention-settings-windows-defender-advanced-threat-protection.md) +##### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md) +##### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md) +##### [Enable Secure score security controls](windows-defender-atp\enable-secure-score-windows-defender-advanced-threat-protection.md) +##### [Configure advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md) + + + +####APIs +##### [Enable Threat intel](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md) + +####Rules +##### [Manage suppression rules](windows-defender-atp\manage-suppression-rules-windows-defender-advanced-threat-protection.md) +##### [Manage automation allowed/blocked](windows-defender-atp\manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) +##### [Manage automation file uploads](windows-defender-atp\manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) +##### [Manage automation folder exclusions](windows-defender-atp\manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) + + +####Machine management +##### [Onboarding machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) +##### [Offboarding machines](windows-defender-atp\offboard-machines-windows-defender-advanced-threat-protection.md) + + +#### [Configure Windows Defender Security Center time zone settings](windows-defender-atp\time-settings-windows-defender-advanced-threat-protection.md) + + +## [Windows Defender Security Center](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) +### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) +### [View the Security operations dashboard - consdier moving to the relevant pillar](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) + + +### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) + + +## [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) +### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) +#### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) +### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) + + +### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) +#### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) + + +#### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) +#### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) +##### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) + + +### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) + + +#### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) +#### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) +### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) + + +#### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) +#### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) + + +#### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) +#### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) +#### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) + + +## [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) +### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +#### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) +#### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) +#### [Configure and validate network connections](windows-defender-antivirus\configure-network-connections-windows-defender-antivirus.md) +#### [Enable the Block at First Sight feature](windows-defender-antivirus\configure-block-at-first-sight-windows-defender-antivirus.md) +#### [Configure the cloud block timeout period](windows-defender-antivirus\configure-cloud-block-timeout-period-windows-defender-antivirus.md) +### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus\configure-protection-features-windows-defender-antivirus.md) +#### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus\detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) +#### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md) + + +## [Endpoint detection and response - Tomer B.](faketopic.md) +###Alerts queue +#### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +#### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) +#### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +#### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +#### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) +#### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +#### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) +#### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md) + + +###Machines list +#### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +#### [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) +#### [Alerts related to this machine](investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) +#### [Machine timeline](investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) +##### [Search for specific events](investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) +##### [Filter events from a specific date](investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) +##### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) +##### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) + + +### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md) +#### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md) +##### [Collect investigation package](respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) +##### [Run antivirus scan](respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) +##### [Restrict app execution](respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) +##### [Remove app restriction](respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) +##### [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) +##### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) +##### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) + + +#### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md) +##### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) +##### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) +##### [Block files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) +##### [Remove file from blocked list](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) +##### [Check activity details in Action center](respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) +##### [Deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) +##### [Submit files for analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) +##### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) +##### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) + + +### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) +#### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) +#### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) + + +## [Automatic investigation and remediation - Benny](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) + + +##Security posture +### [Secure posture - Evald](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) +### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) + + +## [Management and APIs](management-apis.md) +### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md) +#### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) +#### [Configure Splunk to pull alerts](configure-splunk-windows-defender-advanced-threat-protection.md) +#### [Configure HP ArcSight to pull alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) +#### [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) +#### [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md) + +### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) +#### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md) +#####Actor +###### [Get actor information](get-actor-information-windows-defender-advanced-threat-protection.md) +###### [Get actor related alerts](get-actor-related-alerts-windows-defender-advanced-threat-protection.md) +#####Alerts +###### [Get alerts](get-alerts-windows-defender-advanced-threat-protection.md) +###### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection.md) +###### [Get alert related actor information](get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related domain information](get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related IP information](get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) +###### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) +######Domain +####### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection.md) +####### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) + +#####File +###### [Block file API](block-file-windows-defender-advanced-threat-protection.md) +###### [Get file information](get-file-information-windows-defender-advanced-threat-protection.md) +###### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection.md) +###### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection.md) +###### [Get FileActions collection API](get-fileactions-collection-windows-defender-advanced-threat-protection.md) +###### [Unblock file API](unblock-file-windows-defender-advanced-threat-protection.md) + +#####IP +###### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection.md) +###### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection.md) +###### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection.md) +#####Machines +###### [Collect investigation package API](collect-investigation-package-windows-defender-advanced-threat-protection.md) +###### [Find machine information by IP](find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) +###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) +###### [Get FileMachineAction object API](get-filemachineaction-object-windows-defender-advanced-threat-protection.md) +###### [Get FileMachineActions collection API](get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) +###### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection.md) +###### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection.md) +###### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get MachineAction object API](get-machineaction-object-windows-defender-advanced-threat-protection.md) +###### [Get MachineActions collection API](get-machineactions-collection-windows-defender-advanced-threat-protection.md) +###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) +###### [Get package SAS URI API](get-package-sas-uri-windows-defender-advanced-threat-protection.md) +###### [Isolate machine API](isolate-machine-windows-defender-advanced-threat-protection.md) +###### [Release machine from isolation API](unisolate-machine-windows-defender-advanced-threat-protection.md) +###### [Remove app restriction API](unrestrict-code-execution-windows-defender-advanced-threat-protection.md) +###### [Request sample API](request-sample-windows-defender-advanced-threat-protection.md) +###### [Restrict app execution API](restrict-code-execution-windows-defender-advanced-threat-protection.md) +###### [Run antivirus scan API](run-av-scan-windows-defender-advanced-threat-protection.md) +###### [Stop and quarantine file API](stop-quarantine-file-windows-defender-advanced-threat-protection.md) + + +#####User +###### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection.md) +###### [Get user information](get-user-information-windows-defender-advanced-threat-protection.md) +###### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection.md) +###### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection.md) + + +### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md) +#### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) +#### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) +#### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) +#### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) +#### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) +#### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) + +### [Reporting](reporting.md) +#### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) + +### [Permissions](permissions.md) +#### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md) +#### [Create and manage machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md) + + +## [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](integration.md) +### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) + +##Troubleshoot Windows Defender ATP +### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) + + +###Troubleshoot sensor state - Ask Heike name of sensor +#### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) +#### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) +#### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) +#### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) +#### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) + +### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) +#### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) + + + + + + + + + + -### [Windows security baselines](windows-security-baselines.md) -### [Security Compliance Toolkit](security-compliance-toolkit-10.md) -### [Get support](get-support-for-security-baselines.md) -### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) -## [Change history for Threat protection](change-history-for-threat-protection.md) From b60d740cad879efe7afc1947b307962f0cae4ec7 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 15:52:36 +0300 Subject: [PATCH 018/286] fix folder reference --- .../windows-defender-atp/TOC.md | 175 +++++++++--------- 1 file changed, 83 insertions(+), 92 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index eb61137c27..339a14435e 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -1,5 +1,8 @@ + + # [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) + ## [Get started](fake2.md) ### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) ### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) @@ -8,6 +11,7 @@ ### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) ### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) + ### [Evaluate Windows Defender ATP](threat-protection\evaluate.md) #### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) #### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) @@ -17,44 +21,38 @@ #### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) #### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) #### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) - - - + + ## [Onboard and configure machines to Windows Defender ATP](onboard.md) -### [Onboard machines - need to revise this page](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) -#### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md) -#### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md) -##### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md) -##### [Onboard machines using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -##### [Onboard machines using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -###### [Onboard machines using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) -##### [Onboard machines using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md) -##### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) -#### [Onboard servers](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md) -#### [Onboard non-Windows machines](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) -#### [Run a detection test on a newly onboarded machine](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md) -#### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) -#### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) - - +### [Onboard machines - need to revise this page](onboard-configure-windows-defender-advanced-threat-protection.md) +#### [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md) +#### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) +##### [Onboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) +##### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) +##### [Onboard machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) +##### [Onboard machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) +##### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) +#### [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md) +#### [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) +#### [Run a detection test on a newly onboarded machine](run-detection-test-windows-defender-advanced-threat-protection.md) +#### [Run simulated attacks on machines](attack-simulations-windows-defender-advanced-threat-protection.md) +#### [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) ###[Configure Attack surface reduction](configure1.md) #### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) #### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) #### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) - - - - - - + + ### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) #### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) #### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) ##### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) - + + #### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) ##### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) ###### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) @@ -67,6 +65,7 @@ ###### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) ###### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) + #### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) ##### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) ###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) @@ -87,49 +86,43 @@ ##### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) - - - ### [Configure Automatic investigation and remediation - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) - -### [Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) +### [Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md) ####General -##### [Update data retention settings](windows-defender-atp\data-retention-settings-windows-defender-advanced-threat-protection.md) -##### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md) -##### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md) -##### [Enable Secure score security controls](windows-defender-atp\enable-secure-score-windows-defender-advanced-threat-protection.md) -##### [Configure advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md) - - - - +##### [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md) +##### [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md) +##### [Enable and create Power BI reports using Windows Defender Security center data](powerbi-reports-windows-defender-advanced-threat-protection.md) +##### [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md) +##### [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md) + + ####APIs -##### [Enable Threat intel](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md) -##### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md) +##### [Enable Threat intel](enable-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) + ####Rules -##### [Manage suppression rules](windows-defender-atp\manage-suppression-rules-windows-defender-advanced-threat-protection.md) -##### [Manage automation allowed/blocked](windows-defender-atp\manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -##### [Manage automation file uploads](windows-defender-atp\manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) -##### [Manage automation folder exclusions](windows-defender-atp\manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) +##### [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md) +##### [Manage automation allowed/blocked](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) +##### [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) +##### [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) + ####Machine management -##### [Onboarding machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) -##### [Offboarding machines](windows-defender-atp\offboard-machines-windows-defender-advanced-threat-protection.md) - -#### [Configure Windows Defender Security Center time zone settings](windows-defender-atp\time-settings-windows-defender-advanced-threat-protection.md) +##### [Onboarding machines](onboard-configure-windows-defender-advanced-threat-protection.md) +##### [Offboarding machines](offboard-machines-windows-defender-advanced-threat-protection.md) + + +#### [Configure Windows Defender Security Center time zone settings](time-settings-windows-defender-advanced-threat-protection.md) - - -## [Windows Defender Security Center](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) -### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) -### [View the Security operations dashboard - consdier moving to the relevant pillar](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) - -### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) - +## [Windows Defender Security Center](use-windows-defender-advanced-threat-protection.md) +### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) +### [View the Security operations dashboard - consdier moving to the relevant pillar](security-operations-dashboard-windows-defender-advanced-threat-protection.md) + +### [Access the Windows Defender Security Center Community Center](community-windows-defender-advanced-threat-protection.md) ## [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) @@ -140,26 +133,27 @@ ### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) #### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) - + #### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) #### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) ##### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) ### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) - + #### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) #### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) ### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) + #### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) #### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) - #### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) #### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) #### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) + ## [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) ### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) #### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) @@ -172,7 +166,6 @@ #### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md) - ## [Endpoint detection and response - Tomer B.](faketopic.md) ###Alerts queue #### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) @@ -183,7 +176,7 @@ #### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) #### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) #### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md) - + ###Machines list #### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) #### [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) @@ -205,6 +198,7 @@ ##### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) ##### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) + #### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md) ##### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) ##### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) @@ -217,19 +211,17 @@ ##### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) - -### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) -#### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) -#### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) - - -## [Automatic investigation and remediation - Benny](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) +### [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md) +#### [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md) +#### [Advanced hunting query language best practices](advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) +## [Automatic investigation and remediation - Benny](automated-investigations-windows-defender-advanced-threat-protection.md) + + ##Security posture -### [Secure posture - Evald](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) -### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) - +### [Secure posture - Evald](secure-score-dashboard-windows-defender-advanced-threat-protection.md) +### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) ## [Management and APIs](management-apis.md) @@ -241,6 +233,7 @@ #### [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) #### [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md) + ### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) #### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md) #####Actor @@ -260,6 +253,7 @@ ####### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection.md) ####### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) + #####File ###### [Block file API](block-file-windows-defender-advanced-threat-protection.md) ###### [Get file information](get-file-information-windows-defender-advanced-threat-protection.md) @@ -269,6 +263,7 @@ ###### [Get FileActions collection API](get-fileactions-collection-windows-defender-advanced-threat-protection.md) ###### [Unblock file API](unblock-file-windows-defender-advanced-threat-protection.md) + #####IP ###### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection.md) ###### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection.md) @@ -296,7 +291,6 @@ ###### [Stop and quarantine file API](stop-quarantine-file-windows-defender-advanced-threat-protection.md) - #####User ###### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection.md) ###### [Get user information](get-user-information-windows-defender-advanced-threat-protection.md) @@ -304,8 +298,6 @@ ###### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection.md) - - ### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md) #### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) #### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) @@ -315,34 +307,33 @@ #### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) #### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) + ### [Reporting](reporting.md) #### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) -### [Permissions](permissions.md) -#### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md) -#### [Create and manage machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md) +### [Permissions](permissions.md) +#### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md) +#### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) ## [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](integration.md) -### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) - - - +### [Protect users, data, and devices with conditional access](conditional-access-windows-defender-advanced-threat-protection.md) ##Troubleshoot Windows Defender ATP ### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) + ###Troubleshoot sensor state - Ask Heike name of sensor -#### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) -#### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) -#### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) -#### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) -#### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) - -### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) -#### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) +#### [Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md) +#### [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) +#### [Inactive machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) +#### [Misconfigured machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) +#### [Review events and errors on machines with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md) + +### [Troubleshoot Windows Defender ATP service issues](troubleshoot-windows-defender-advanced-threat-protection.md) +#### [Check service health](service-status-windows-defender-advanced-threat-protection.md) From b5c42041b488c8e574f458e717794cec6042c7f8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 16:35:02 +0300 Subject: [PATCH 019/286] add table in threat prot page --- windows/security/threat-protection/index.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index b589ac9a69..01cf2ddc25 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -32,5 +32,13 @@ In conjunction with being able to quickly respond to advanced attacks, Windows D Windows Defender ATP provides a security posture capability to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security state of your network. +Attack surface reduction | Next generation protection | Endpoint detection and response | Auto investigation | Security posture | Advanced hunting | Management and APIs | Microsoft threat protection +:---|:---|:---|:---|:---|:---|:---|:--- +[Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview)

[Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

[Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

[Network firewall](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

[Attack surface reducation controls](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)| [Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)

[Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus) [Automated sandbox service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus)| [Alerts queue](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection)

[Historical endpoint data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection#machine-timeline)

[Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

[API and SIEM integration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

[Response orchestration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection)

[Forensic collection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection#collect-investigation-package-from-machines)

[Threat intelligence](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection)

[Advanced detonation and analysis service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#deep-analysis)

| [Automated investigation and remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)

[Threat remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#how-threats-are-remediated)

[Manage automated investigations](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#manage-automated-investigations)

[Analyze automated investigation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#analyze-automated-investigations)|[Asset inventory](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Recommended improvement actions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Secure score](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection)| [Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

Scheduled queries

Scheduled queries (Github)

[Custom TI](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection) | [Onboarding](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection)

[Configuration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection)

[Operating system baseline compliance](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[SIEM connectors](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

[Exposed APIs](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection)

[RBAC](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection)

[Reportin and trends](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection)| [Conditional access](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection)

O365 ATP

Azure ATP

Azure Security Center

Skype for Business

Cloud App Security + + + + + From 5347a12bbac65e42b514625290852d0539efde2f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 13:48:10 +0000 Subject: [PATCH 020/286] Updated threat-prot level TOC.md --- windows/security/threat-protection/TOC.md | 640 +++++++++++----------- 1 file changed, 307 insertions(+), 333 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 8fe3e22d50..828689473e 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -1,336 +1,310 @@ -# [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) - -## [Get started](fake2.md) -### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) -### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) -### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) -### [Preview features](preview-windows-defender-advanced-threat-protection.md) -### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) -### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) - -### [Evaluate Windows Defender ATP](threat-protection/evaluate.md) -#### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) -#### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) -#### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) -#### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) -#### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) -#### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) -#### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) -#### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) - - -## [Onboard and configure machines to Windows Defender ATP](threat-protection/onboard.md) -### [Onboard machines - need to revise this page](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) -#### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md) -#### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md) -##### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md) -##### [Onboard machines using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -##### [Onboard machines using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -###### [Onboard machines using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) -##### [Onboard machines using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md) -##### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) -#### [Onboard servers](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md) -#### [Onboard non-Windows machines](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) -#### [Run a detection test on a newly onboarded machine](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md) -#### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) -#### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) - - -###[Configure ASR](configure1.md) -#### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) -#### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -#### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) - - -### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) -#### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) -#### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) -##### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) - - -#### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) -##### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) -###### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) -##### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) -###### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) -##### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) -###### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) -###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) -###### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) -###### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) -###### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) - - -#### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) -##### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md) -###### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) -##### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) -##### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md) -##### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md) -##### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md) -##### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) -##### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) -#### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) -#### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) -##### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) -##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) -##### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) -##### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) -##### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) - - - -### [Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) - - - -### [Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) -####General -##### [Update data retention settings](windows-defender-atp\data-retention-settings-windows-defender-advanced-threat-protection.md) -##### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md) -##### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md) -##### [Enable Secure score security controls](windows-defender-atp\enable-secure-score-windows-defender-advanced-threat-protection.md) -##### [Configure advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md) - - - -####APIs -##### [Enable Threat intel](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md) -##### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md) - -####Rules -##### [Manage suppression rules](windows-defender-atp\manage-suppression-rules-windows-defender-advanced-threat-protection.md) -##### [Manage automation allowed/blocked](windows-defender-atp\manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -##### [Manage automation file uploads](windows-defender-atp\manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) -##### [Manage automation folder exclusions](windows-defender-atp\manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) - - -####Machine management -##### [Onboarding machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) -##### [Offboarding machines](windows-defender-atp\offboard-machines-windows-defender-advanced-threat-protection.md) - - -#### [Configure Windows Defender Security Center time zone settings](windows-defender-atp\time-settings-windows-defender-advanced-threat-protection.md) - - -## [Windows Defender Security Center](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) -### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) -### [View the Security operations dashboard - consdier moving to the relevant pillar](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) - - -### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) - - -## [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) -### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) -#### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) -### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) - - -### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) -#### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) - - -#### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) -#### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) -##### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) - - -### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) - - -#### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) -#### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) -### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) - - -#### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) -#### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) - - -#### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) -#### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) -#### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) - - -## [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) -### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -#### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) -#### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) -#### [Configure and validate network connections](windows-defender-antivirus\configure-network-connections-windows-defender-antivirus.md) -#### [Enable the Block at First Sight feature](windows-defender-antivirus\configure-block-at-first-sight-windows-defender-antivirus.md) -#### [Configure the cloud block timeout period](windows-defender-antivirus\configure-cloud-block-timeout-period-windows-defender-antivirus.md) -### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus\configure-protection-features-windows-defender-antivirus.md) -#### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus\detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) -#### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md) - - -## [Endpoint detection and response - Tomer B.](faketopic.md) -###Alerts queue -#### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -#### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) -#### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -#### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) -#### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) -#### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) -#### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) -#### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md) - - -###Machines list -#### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) -#### [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) -#### [Alerts related to this machine](investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) -#### [Machine timeline](investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) -##### [Search for specific events](investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) -##### [Filter events from a specific date](investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) -##### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) -##### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) - - -### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md) -#### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md) -##### [Collect investigation package](respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) -##### [Run antivirus scan](respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) -##### [Restrict app execution](respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) -##### [Remove app restriction](respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) -##### [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) -##### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) -##### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) - - -#### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md) -##### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) -##### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) -##### [Block files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) -##### [Remove file from blocked list](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) -##### [Check activity details in Action center](respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) -##### [Deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) -##### [Submit files for analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) -##### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) -##### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) - - -### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) -#### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) -#### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) - - -## [Automatic investigation and remediation - Benny](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) - - -##Security posture -### [Secure posture - Evald](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) -### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) - - -## [Management and APIs](management-apis.md) -### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md) -#### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) -#### [Configure Splunk to pull alerts](configure-splunk-windows-defender-advanced-threat-protection.md) -#### [Configure HP ArcSight to pull alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) -#### [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) -#### [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md) - -### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) -#### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md) -#####Actor -###### [Get actor information](get-actor-information-windows-defender-advanced-threat-protection.md) -###### [Get actor related alerts](get-actor-related-alerts-windows-defender-advanced-threat-protection.md) -#####Alerts -###### [Get alerts](get-alerts-windows-defender-advanced-threat-protection.md) -###### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection.md) -###### [Get alert related actor information](get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related domain information](get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related IP information](get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) -######Domain -####### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection.md) -####### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection.md) -####### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection.md) -####### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) - -#####File -###### [Block file API](block-file-windows-defender-advanced-threat-protection.md) -###### [Get file information](get-file-information-windows-defender-advanced-threat-protection.md) -###### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection.md) -###### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection.md) -###### [Get FileActions collection API](get-fileactions-collection-windows-defender-advanced-threat-protection.md) -###### [Unblock file API](unblock-file-windows-defender-advanced-threat-protection.md) - -#####IP -###### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection.md) -###### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection.md) -###### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection.md) -#####Machines -###### [Collect investigation package API](collect-investigation-package-windows-defender-advanced-threat-protection.md) -###### [Find machine information by IP](find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) -###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) -###### [Get FileMachineAction object API](get-filemachineaction-object-windows-defender-advanced-threat-protection.md) -###### [Get FileMachineActions collection API](get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) -###### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection.md) -###### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection.md) -###### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get MachineAction object API](get-machineaction-object-windows-defender-advanced-threat-protection.md) -###### [Get MachineActions collection API](get-machineactions-collection-windows-defender-advanced-threat-protection.md) -###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) -###### [Get package SAS URI API](get-package-sas-uri-windows-defender-advanced-threat-protection.md) -###### [Isolate machine API](isolate-machine-windows-defender-advanced-threat-protection.md) -###### [Release machine from isolation API](unisolate-machine-windows-defender-advanced-threat-protection.md) -###### [Remove app restriction API](unrestrict-code-execution-windows-defender-advanced-threat-protection.md) -###### [Request sample API](request-sample-windows-defender-advanced-threat-protection.md) -###### [Restrict app execution API](restrict-code-execution-windows-defender-advanced-threat-protection.md) -###### [Run antivirus scan API](run-av-scan-windows-defender-advanced-threat-protection.md) -###### [Stop and quarantine file API](stop-quarantine-file-windows-defender-advanced-threat-protection.md) - - -#####User -###### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection.md) -###### [Get user information](get-user-information-windows-defender-advanced-threat-protection.md) -###### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection.md) - - -### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -#### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) -#### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) -#### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) -#### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) - -### [Reporting](reporting.md) -#### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) - -### [Permissions](permissions.md) -#### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md) -#### [Create and manage machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md) - - -## [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](integration.md) -### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) - -##Troubleshoot Windows Defender ATP -### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) - - -###Troubleshoot sensor state - Ask Heike name of sensor -#### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) -#### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) -#### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) -#### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) -#### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) - -### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) -#### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) +# [Threat protection](index.md) + +## [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) + +### [Get started](fake2.md) +#### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) +#### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) +#### [Preview features](preview-windows-defender-advanced-threat-protection.md) +#### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) +#### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) + +#### [Evaluate Windows Defender ATP](threat-protection/evaluate.md) +##### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) +##### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) +##### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) +##### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) +##### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) +##### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) +##### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) +##### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) + +### [Onboard and configure machines to Windows Defender ATP](threat-protection/onboard.md) +#### [Onboard machines - need to revise this page](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) +##### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md) +##### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) +####### [Onboard machines using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) +###### [Onboard machines using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md) +###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) +##### [Onboard servers](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md) +##### [Onboard non-Windows machines](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) +##### [Run a detection test on a newly onboarded machine](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md) +##### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) +##### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) + +####[Configure ASR](configure1.md) +##### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) +##### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) +##### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) + +#### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) +##### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) +##### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) +###### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) + +##### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) +###### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) +####### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) +###### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) +####### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) +###### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) +####### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) +####### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) +####### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) +####### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) +####### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) + +##### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) +###### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) +####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) +####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md) +####### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) +###### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) +###### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md) +###### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md) +###### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md) +###### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) +###### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) +##### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) +##### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) +###### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) +###### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) +###### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) +###### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) +###### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) + +#### [Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) + +#### [Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) +#####General +###### [Update data retention settings](windows-defender-atp\data-retention-settings-windows-defender-advanced-threat-protection.md) +###### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md) +###### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md) +###### [Enable Secure score security controls](windows-defender-atp\enable-secure-score-windows-defender-advanced-threat-protection.md) +###### [Configure advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md) + +#####APIs +###### [Enable Threat intel](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md) +###### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md) + +#####Rules +###### [Manage suppression rules](windows-defender-atp\manage-suppression-rules-windows-defender-advanced-threat-protection.md) +###### [Manage automation allowed/blocked](windows-defender-atp\manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) +###### [Manage automation file uploads](windows-defender-atp\manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) +###### [Manage automation folder exclusions](windows-defender-atp\manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) + +#####Machine management +###### [Onboarding machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) +###### [Offboarding machines](windows-defender-atp\offboard-machines-windows-defender-advanced-threat-protection.md) + +##### [Configure Windows Defender Security Center time zone settings](windows-defender-atp\time-settings-windows-defender-advanced-threat-protection.md) + +### [Windows Defender Security Center](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) +#### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) +#### [View the Security operations dashboard - consdier moving to the relevant pillar](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) + +#### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) + # + # +### [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) +#### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) +##### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) +#### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) + +#### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) +##### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) + +##### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) +##### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) +###### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) + +#### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) + +##### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) +##### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) +#### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) + +##### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) +##### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) + +##### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) +##### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) +##### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) + +### [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) +#### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +##### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) +##### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) +##### [Configure and validate network connections](windows-defender-antivirus\configure-network-connections-windows-defender-antivirus.md) +##### [Enable the Block at First Sight feature](windows-defender-antivirus\configure-block-at-first-sight-windows-defender-antivirus.md) +##### [Configure the cloud block timeout period](windows-defender-antivirus\configure-cloud-block-timeout-period-windows-defender-antivirus.md) +#### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus\configure-protection-features-windows-defender-antivirus.md) +##### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus\detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) +##### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md) + +### [Endpoint detection and response - Tomer B.](faketopic.md) +####Alerts queue +##### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) +##### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) +##### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) +##### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) +##### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) +##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) +##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) +##### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md) + +####Machines list +##### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +##### [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) +##### [Alerts related to this machine](investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) +##### [Machine timeline](investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) +###### [Search for specific events](investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) +###### [Filter events from a specific date](investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) +###### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) +###### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) + +#### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md) +##### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md) +###### [Collect investigation package](respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) +###### [Run antivirus scan](respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) +###### [Restrict app execution](respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) +###### [Remove app restriction](respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) +###### [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) +###### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) +###### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) + +##### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md) +###### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) +###### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) +###### [Block files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) +###### [Remove file from blocked list](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) +###### [Check activity details in Action center](respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) +###### [Deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) +###### [Submit files for analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) +###### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) +###### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) + +#### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) +##### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) +##### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) + +### [Automatic investigation and remediation - Benny](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) + +###Security posture +#### [Secure posture - Evald](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) +#### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) + +### [Management and APIs](management-apis.md) +#### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md) +##### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) +##### [Configure Splunk to pull alerts](configure-splunk-windows-defender-advanced-threat-protection.md) +##### [Configure HP ArcSight to pull alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) +##### [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) +##### [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md) + +#### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) +##### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md) +######Actor +####### [Get actor information](get-actor-information-windows-defender-advanced-threat-protection.md) +####### [Get actor related alerts](get-actor-related-alerts-windows-defender-advanced-threat-protection.md) +######Alerts +####### [Get alerts](get-alerts-windows-defender-advanced-threat-protection.md) +####### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection.md) +####### [Get alert related actor information](get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related domain information](get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related IP information](get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) +#######Domain +######## [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection.md) +######## [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection.md) +######## [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection.md) +######## [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) + +######File +####### [Block file API](block-file-windows-defender-advanced-threat-protection.md) +####### [Get file information](get-file-information-windows-defender-advanced-threat-protection.md) +####### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection.md) +####### [Get FileActions collection API](get-fileactions-collection-windows-defender-advanced-threat-protection.md) +####### [Unblock file API](unblock-file-windows-defender-advanced-threat-protection.md) + +######IP +####### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection.md) +####### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection.md) +######Machines +####### [Collect investigation package API](collect-investigation-package-windows-defender-advanced-threat-protection.md) +####### [Find machine information by IP](find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) +####### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) +####### [Get FileMachineAction object API](get-filemachineaction-object-windows-defender-advanced-threat-protection.md) +####### [Get FileMachineActions collection API](get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) +####### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection.md) +####### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection.md) +####### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get MachineAction object API](get-machineaction-object-windows-defender-advanced-threat-protection.md) +####### [Get MachineActions collection API](get-machineactions-collection-windows-defender-advanced-threat-protection.md) +####### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) +####### [Get package SAS URI API](get-package-sas-uri-windows-defender-advanced-threat-protection.md) +####### [Isolate machine API](isolate-machine-windows-defender-advanced-threat-protection.md) +####### [Release machine from isolation API](unisolate-machine-windows-defender-advanced-threat-protection.md) +####### [Remove app restriction API](unrestrict-code-execution-windows-defender-advanced-threat-protection.md) +####### [Request sample API](request-sample-windows-defender-advanced-threat-protection.md) +####### [Restrict app execution API](restrict-code-execution-windows-defender-advanced-threat-protection.md) +####### [Run antivirus scan API](run-av-scan-windows-defender-advanced-threat-protection.md) +####### [Stop and quarantine file API](stop-quarantine-file-windows-defender-advanced-threat-protection.md) + +######User +####### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection.md) +####### [Get user information](get-user-information-windows-defender-advanced-threat-protection.md) +####### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection.md) + +#### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) +##### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) +##### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) +##### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) +##### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) + +#### [Reporting](reporting.md) +##### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) + +#### [Permissions](permissions.md) +##### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md) +##### [Create and manage machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md) + +### [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](integration.md) +#### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) + +###Troubleshoot Windows Defender ATP +#### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) + +####Troubleshoot sensor state - Ask Heike name of sensor +##### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) +##### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) +##### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) +##### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) +##### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) + +#### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) +##### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) + + + + + + From 7b19cff20ec5d1b667d66805bf833696b1511b18 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 16:54:04 +0300 Subject: [PATCH 021/286] revert toc --- windows/security/threat-protection/TOC.md | 1289 +++++++++++++++------ 1 file changed, 956 insertions(+), 333 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 8fe3e22d50..ee265a3955 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -1,336 +1,348 @@ -# [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) - -## [Get started](fake2.md) -### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) -### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) -### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) -### [Preview features](preview-windows-defender-advanced-threat-protection.md) -### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) -### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) - -### [Evaluate Windows Defender ATP](threat-protection/evaluate.md) -#### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) -#### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) -#### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) -#### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) -#### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) -#### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) -#### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) -#### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) - - -## [Onboard and configure machines to Windows Defender ATP](threat-protection/onboard.md) -### [Onboard machines - need to revise this page](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) -#### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md) -#### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md) -##### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md) -##### [Onboard machines using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -##### [Onboard machines using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -###### [Onboard machines using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) -##### [Onboard machines using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md) -##### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) -#### [Onboard servers](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md) -#### [Onboard non-Windows machines](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) -#### [Run a detection test on a newly onboarded machine](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md) -#### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) -#### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) - - -###[Configure ASR](configure1.md) -#### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) -#### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -#### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) - - -### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) -#### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) -#### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) -##### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) - - -#### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) -##### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) -###### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) -##### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) -###### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) -##### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) -###### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) -###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) -###### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) -###### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) -###### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) - - -#### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) -##### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md) -###### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) -##### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) -##### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md) -##### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md) -##### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md) -##### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) -##### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) -#### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) -#### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) -##### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) -##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) -##### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) -##### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) -##### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) - - - -### [Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) - - - -### [Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) -####General -##### [Update data retention settings](windows-defender-atp\data-retention-settings-windows-defender-advanced-threat-protection.md) -##### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md) -##### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md) -##### [Enable Secure score security controls](windows-defender-atp\enable-secure-score-windows-defender-advanced-threat-protection.md) -##### [Configure advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md) - - - -####APIs -##### [Enable Threat intel](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md) -##### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md) - -####Rules -##### [Manage suppression rules](windows-defender-atp\manage-suppression-rules-windows-defender-advanced-threat-protection.md) -##### [Manage automation allowed/blocked](windows-defender-atp\manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -##### [Manage automation file uploads](windows-defender-atp\manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) -##### [Manage automation folder exclusions](windows-defender-atp\manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) - - -####Machine management -##### [Onboarding machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) -##### [Offboarding machines](windows-defender-atp\offboard-machines-windows-defender-advanced-threat-protection.md) - - -#### [Configure Windows Defender Security Center time zone settings](windows-defender-atp\time-settings-windows-defender-advanced-threat-protection.md) - - -## [Windows Defender Security Center](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) -### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) -### [View the Security operations dashboard - consdier moving to the relevant pillar](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) - - -### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) - - -## [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) -### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) -#### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) -### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) - - -### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) -#### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) - - -#### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) -#### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) -##### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) - - -### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) - - -#### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) -#### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) -### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) - - -#### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) -#### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) - - -#### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) -#### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) -#### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) - - -## [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) -### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -#### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) -#### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) -#### [Configure and validate network connections](windows-defender-antivirus\configure-network-connections-windows-defender-antivirus.md) -#### [Enable the Block at First Sight feature](windows-defender-antivirus\configure-block-at-first-sight-windows-defender-antivirus.md) -#### [Configure the cloud block timeout period](windows-defender-antivirus\configure-cloud-block-timeout-period-windows-defender-antivirus.md) -### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus\configure-protection-features-windows-defender-antivirus.md) -#### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus\detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) -#### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md) - - -## [Endpoint detection and response - Tomer B.](faketopic.md) -###Alerts queue -#### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) -#### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) -#### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) -#### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) -#### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) -#### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) -#### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) -#### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md) - - -###Machines list -#### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) -#### [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) -#### [Alerts related to this machine](investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) -#### [Machine timeline](investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) -##### [Search for specific events](investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) -##### [Filter events from a specific date](investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) -##### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) -##### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) - - -### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md) -#### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md) -##### [Collect investigation package](respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) -##### [Run antivirus scan](respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) -##### [Restrict app execution](respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) -##### [Remove app restriction](respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) -##### [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) -##### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) -##### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) - - -#### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md) -##### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) -##### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) -##### [Block files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) -##### [Remove file from blocked list](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) -##### [Check activity details in Action center](respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) -##### [Deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) -##### [Submit files for analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) -##### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) -##### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) - - -### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) -#### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) -#### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) - - -## [Automatic investigation and remediation - Benny](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) - - -##Security posture -### [Secure posture - Evald](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) -### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) - - -## [Management and APIs](management-apis.md) -### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md) -#### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) -#### [Configure Splunk to pull alerts](configure-splunk-windows-defender-advanced-threat-protection.md) -#### [Configure HP ArcSight to pull alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) -#### [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) -#### [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md) - -### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) -#### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md) -#####Actor -###### [Get actor information](get-actor-information-windows-defender-advanced-threat-protection.md) -###### [Get actor related alerts](get-actor-related-alerts-windows-defender-advanced-threat-protection.md) -#####Alerts -###### [Get alerts](get-alerts-windows-defender-advanced-threat-protection.md) -###### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection.md) -###### [Get alert related actor information](get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related domain information](get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related IP information](get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) -###### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) -######Domain -####### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection.md) -####### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection.md) -####### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection.md) -####### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) - -#####File -###### [Block file API](block-file-windows-defender-advanced-threat-protection.md) -###### [Get file information](get-file-information-windows-defender-advanced-threat-protection.md) -###### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection.md) -###### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection.md) -###### [Get FileActions collection API](get-fileactions-collection-windows-defender-advanced-threat-protection.md) -###### [Unblock file API](unblock-file-windows-defender-advanced-threat-protection.md) - -#####IP -###### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection.md) -###### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection.md) -###### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection.md) -#####Machines -###### [Collect investigation package API](collect-investigation-package-windows-defender-advanced-threat-protection.md) -###### [Find machine information by IP](find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) -###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) -###### [Get FileMachineAction object API](get-filemachineaction-object-windows-defender-advanced-threat-protection.md) -###### [Get FileMachineActions collection API](get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) -###### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection.md) -###### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection.md) -###### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get MachineAction object API](get-machineaction-object-windows-defender-advanced-threat-protection.md) -###### [Get MachineActions collection API](get-machineactions-collection-windows-defender-advanced-threat-protection.md) -###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) -###### [Get package SAS URI API](get-package-sas-uri-windows-defender-advanced-threat-protection.md) -###### [Isolate machine API](isolate-machine-windows-defender-advanced-threat-protection.md) -###### [Release machine from isolation API](unisolate-machine-windows-defender-advanced-threat-protection.md) -###### [Remove app restriction API](unrestrict-code-execution-windows-defender-advanced-threat-protection.md) -###### [Request sample API](request-sample-windows-defender-advanced-threat-protection.md) -###### [Restrict app execution API](restrict-code-execution-windows-defender-advanced-threat-protection.md) -###### [Run antivirus scan API](run-av-scan-windows-defender-advanced-threat-protection.md) -###### [Stop and quarantine file API](stop-quarantine-file-windows-defender-advanced-threat-protection.md) - - -#####User -###### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection.md) -###### [Get user information](get-user-information-windows-defender-advanced-threat-protection.md) -###### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection.md) -###### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection.md) - - -### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -#### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) -#### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) -#### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) -#### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) - -### [Reporting](reporting.md) -#### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) - -### [Permissions](permissions.md) -#### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md) -#### [Create and manage machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md) - - -## [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](integration.md) -### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) - -##Troubleshoot Windows Defender ATP -### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) - - -###Troubleshoot sensor state - Ask Heike name of sensor -#### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) -#### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) -#### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) -#### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) -#### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) - -### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) -#### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) +# [Threat protection](index.md) + + + + + + +## [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) + +### [Get started](fake2.md) +#### [Minimum requirements](windows-defender-atp\minimum-requirements-windows-defender-advanced-threat-protection.md) +#### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) +#### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md) +#### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) +#### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) + +#### [Evaluate Windows Defender ATP](evaluate.md) +##### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +##### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) +##### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) +##### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) +##### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) +##### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) +##### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) +##### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) + + + +### [Onboard and configure machines to Windows Defender ATP](onboard.md) +#### [Onboard machines - need to revise this page](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) +##### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md) +##### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) +####### [Onboard machines using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) +###### [Onboard machines using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md) +###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) +##### [Onboard servers](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md) +##### [Onboard non-Windows machines](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) +##### [Run a detection test on a newly onboarded machine](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md) +##### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) +##### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) + + + + +####[Configure ASR](configure1.md) +##### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) +##### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) +##### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) + + + + + + +#### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) +##### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) +##### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) +###### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) + +##### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) +###### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) +####### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) +###### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) +####### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) +###### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) +####### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) +####### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) +####### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) +####### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) +####### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) + +##### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) +###### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) +####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) +####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md) +####### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) +###### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) +###### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md) +###### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md) +###### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md) +###### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) +###### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) +##### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) +##### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) +###### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) +###### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) +###### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) +###### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) +###### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) + + + + + +#### [Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) + + + +#### [Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md) +#####General +###### [Update data retention settings](windows-defender-atp\data-retention-settings-windows-defender-advanced-threat-protection.md) +###### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md) +###### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md) +###### [Enable Secure score security controls](windows-defender-atp\enable-secure-score-windows-defender-advanced-threat-protection.md) +###### [Configure advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md) + + + + +#####APIs +###### [Enable Threat intel](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md) +###### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md) + +#####Rules +###### [Manage suppression rules](windows-defender-atp\manage-suppression-rules-windows-defender-advanced-threat-protection.md) +###### [Manage automation allowed/blocked](windows-defender-atp\manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) +###### [Manage automation file uploads](windows-defender-atp\manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) +###### [Manage automation folder exclusions](windows-defender-atp\manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) + +#####Machine management +###### [Onboarding machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) +###### [Offboarding machines](windows-defender-atp\offboard-machines-windows-defender-advanced-threat-protection.md) + +##### [Configure Windows Defender Security Center time zone settings](windows-defender-atp\time-settings-windows-defender-advanced-threat-protection.md) + + + + +### [Windows Defender Security Center](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) +#### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) +#### [View the Security operations dashboard - consdier moving to the relevant pillar](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) + +#### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) + + + + + + + + + + + + + +### [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) +#### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) +##### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) +#### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) + + +#### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) +##### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) + +##### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) +##### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) +###### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) + +#### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) + +##### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) +##### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) +#### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) + +##### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) +##### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) + + + +##### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) +##### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) +##### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) + +### [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) +#### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +##### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) +##### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) +##### [Configure and validate network connections](windows-defender-antivirus\configure-network-connections-windows-defender-antivirus.md) +##### [Enable the Block at First Sight feature](windows-defender-antivirus\configure-block-at-first-sight-windows-defender-antivirus.md) +##### [Configure the cloud block timeout period](windows-defender-antivirus\configure-cloud-block-timeout-period-windows-defender-antivirus.md) +#### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus\configure-protection-features-windows-defender-antivirus.md) +##### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus\detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) +##### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md) + + + +### [Endpoint detection and response - Tomer B.](faketopic.md) +####Alerts queue +##### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) +##### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md) +##### [Investigate alerts](windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md) +##### [Investigate files](windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md) +##### [Investigate machines](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md) +##### [Investigate an IP address](windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md) +##### [Investigate a domain](windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md) +##### [Investigate a user account](windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md) + +####Machines list +##### [View and organize the Machines list](windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md) +##### [Manage machine group and tags](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) +##### [Alerts related to this machine](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) +##### [Machine timeline](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) +###### [Search for specific events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) +###### [Filter events from a specific date](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) +###### [Export machine timeline events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) +###### [Navigate between pages](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) + + +#### [Take response actions](windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md) +##### [Take response actions on a machine](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md) +###### [Collect investigation package](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) +###### [Run antivirus scan](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) +###### [Restrict app execution](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) +###### [Remove app restriction](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) +###### [Isolate machines from the network](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) +###### [Release machine from isolation](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) +###### [Check activity details in Action center](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) + +##### [Take response actions on a file](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md) +###### [Stop and quarantine files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) +###### [Remove file from quarantine](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) +###### [Block files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) +###### [Remove file from blocked list](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) +###### [Check activity details in Action center](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) +###### [Deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) +###### [Submit files for analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) +###### [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) +###### [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) + + + +#### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md) +##### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md) +##### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) + + +### [Automatic investigation and remediation - Benny](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) + + +###Security posture +#### [Secure posture - Evald](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) +#### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) + + + +### [Management and APIs](management-apis.md) +#### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) +##### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) +##### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md) +##### [Configure HP ArcSight to pull alerts](windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md) +##### [Windows Defender ATP alert API fields](windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md) +##### [Pull alerts using REST API](windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md) + +#### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md) +##### [Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md) +######Actor +####### [Get actor information](windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md) +####### [Get actor related alerts](windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md) +######Alerts +####### [Get alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md) +####### [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md) +####### [Get alert related actor information](windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related domain information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related IP information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) +#######Domain +######## [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md) +######## [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md) +######## [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md) +######## [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) + +######File +####### [Block file API](windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md) +####### [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md) +####### [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md) +####### [Get FileActions collection API](windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md) +####### [Unblock file API](windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md) + +######IP +####### [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md) +####### [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md) +######Machines +####### [Collect investigation package API](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md) +####### [Find machine information by IP](windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) +####### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) +####### [Get FileMachineAction object API](windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md) +####### [Get FileMachineActions collection API](windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) +####### [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md) +####### [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md) +####### [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get MachineAction object API](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md) +####### [Get MachineActions collection API](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md) +####### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) +####### [Get package SAS URI API](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md) +####### [Isolate machine API](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md) +####### [Release machine from isolation API](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md) +####### [Remove app restriction API](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md) +####### [Request sample API](windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md) +####### [Restrict app execution API](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md) +####### [Run antivirus scan API](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md) +####### [Stop and quarantine file API](windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md) + + + +######User +####### [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md) +####### [Get user information](windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md) +####### [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md) + + + + +#### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md) +##### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md) +##### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md) +##### [Python code examples](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md) +##### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) + +#### [Reporting](reporting.md) +##### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) + +#### [Permissions](permissions.md) +##### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md) +##### [Create and manage machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md) + + + +### [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](integration.md) +#### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) @@ -349,3 +361,614 @@ + + + + +###Troubleshoot Windows Defender ATP +#### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) + +####Troubleshoot sensor state - Ask Heike name of sensor +##### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) +##### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) +##### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) +##### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) +##### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) + +#### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) +##### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) + + + + + + + + + + + + + + + + + + +## Other security features +### [The Windows Security app](windows-defender-security-center/windows-defender-security-center.md) +#### [Customize the Windows Security app for your organization](windows-defender-security-center/wdsc-customize-contact-information.md) +#### [Hide Windows Security app notifications](windows-defender-security-center/wdsc-hide-notifications.md) +#### [Manage Windows Security app in Windows 10 in S mode](windows-defender-security-center\wdsc-windows-10-in-s-mode.md) +#### [Virus and threat protection](windows-defender-security-center/wdsc-virus-threat-protection.md) +#### [Account protection](windows-defender-security-center\wdsc-account-protection.md) +#### [Firewall and network protection](windows-defender-security-center\wdsc-firewall-network-protection.md) +#### [App and browser control](windows-defender-security-center\wdsc-app-browser-control.md) +#### [Device security](windows-defender-security-center\wdsc-device-security.md) +#### [Device performance and health](windows-defender-security-center\wdsc-device-performance-health.md) +#### [Family options](windows-defender-security-center\wdsc-family-options.md) + + +### [Windows Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) +#### [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) +#### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) + + +### [Windows Defender Device Guard: virtualization-based security and WDAC](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) + + +### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) + +### [Mitigate threats by using Windows 10 security features](overview-of-threat-mitigations-in-windows-10.md) + +### [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) + +### [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-intrusion-detection.md) + +### [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) + +### [Security auditing](auditing/security-auditing-overview.md) + +#### [Basic security audit policies](auditing/basic-security-audit-policies.md) +##### [Create a basic audit policy for an event category](auditing/create-a-basic-audit-policy-settings-for-an-event-category.md) +##### [Apply a basic audit policy on a file or folder](auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md) +##### [View the security event log](auditing/view-the-security-event-log.md) + +##### [Basic security audit policy settings](auditing/basic-security-audit-policy-settings.md) +###### [Audit account logon events](auditing/basic-audit-account-logon-events.md) +###### [Audit account management](auditing/basic-audit-account-management.md) +###### [Audit directory service access](auditing/basic-audit-directory-service-access.md) +###### [Audit logon events](auditing/basic-audit-logon-events.md) +###### [Audit object access](auditing/basic-audit-object-access.md) +###### [Audit policy change](auditing/basic-audit-policy-change.md) +###### [Audit privilege use](auditing/basic-audit-privilege-use.md) +###### [Audit process tracking](auditing/basic-audit-process-tracking.md) +###### [Audit system events](auditing/basic-audit-system-events.md) + +##### [Advanced security audit policies](auditing/advanced-security-auditing.md) +###### [Planning and deploying advanced security audit policies](auditing/planning-and-deploying-advanced-security-audit-policies.md) +###### [Advanced security auditing FAQ](auditing/advanced-security-auditing-faq.md) +####### [Which editions of Windows support advanced audit policy configuration](auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md) + +###### [Using advanced security auditing options to monitor dynamic access control objects](auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) +####### [Monitor the central access policies that apply on a file server](auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md) +####### [Monitor the use of removable storage devices](auditing/monitor-the-use-of-removable-storage-devices.md) +####### [Monitor resource attribute definitions](auditing/monitor-resource-attribute-definitions.md) +####### [Monitor central access policy and rule definitions](auditing/monitor-central-access-policy-and-rule-definitions.md) +####### [Monitor user and device claims during sign-in](auditing/monitor-user-and-device-claims-during-sign-in.md) +####### [Monitor the resource attributes on files and folders](auditing/monitor-the-resource-attributes-on-files-and-folders.md) +####### [Monitor the central access policies associated with files and folders](auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md) +####### [Monitor claim types](auditing/monitor-claim-types.md) + +###### [Advanced security audit policy settings](auditing/advanced-security-audit-policy-settings.md) +####### [Audit Credential Validation](auditing/audit-credential-validation.md) +####### [Event 4774 S, F: An account was mapped for logon.](auditing/event-4774.md) +####### [Event 4775 F: An account could not be mapped for logon.](auditing/event-4775.md) +####### [Event 4776 S, F: The computer attempted to validate the credentials for an account.](auditing/event-4776.md) +####### [Event 4777 F: The domain controller failed to validate the credentials for an account.](auditing/event-4777.md) +###### [Audit Kerberos Authentication Service](auditing/audit-kerberos-authentication-service.md) +####### [Event 4768 S, F: A Kerberos authentication ticket, TGT, was requested.](auditing/event-4768.md) +####### [Event 4771 F: Kerberos pre-authentication failed.](auditing/event-4771.md) +####### [Event 4772 F: A Kerberos authentication ticket request failed.](auditing/event-4772.md) +###### [Audit Kerberos Service Ticket Operations](auditing/audit-kerberos-service-ticket-operations.md) +####### [Event 4769 S, F: A Kerberos service ticket was requested.](auditing/event-4769.md) +####### [Event 4770 S: A Kerberos service ticket was renewed.](auditing/event-4770.md) +####### [Event 4773 F: A Kerberos service ticket request failed.](auditing/event-4773.md) +###### [Audit Other Account Logon Events](auditing/audit-other-account-logon-events.md) +###### [Audit Application Group Management](auditing/audit-application-group-management.md) +###### [Audit Computer Account Management](auditing/audit-computer-account-management.md) +####### [Event 4741 S: A computer account was created.](auditing/event-4741.md) +####### [Event 4742 S: A computer account was changed.](auditing/event-4742.md) +####### [Event 4743 S: A computer account was deleted.](auditing/event-4743.md) +###### [Audit Distribution Group Management](auditing/audit-distribution-group-management.md) +####### [Event 4749 S: A security-disabled global group was created.](auditing/event-4749.md) +####### [Event 4750 S: A security-disabled global group was changed.](auditing/event-4750.md) +####### [Event 4751 S: A member was added to a security-disabled global group.](auditing/event-4751.md) +####### [Event 4752 S: A member was removed from a security-disabled global group.](auditing/event-4752.md) +####### [Event 4753 S: A security-disabled global group was deleted.](auditing/event-4753.md) +###### [Audit Other Account Management Events](auditing/audit-other-account-management-events.md) +####### [Event 4782 S: The password hash an account was accessed.](auditing/event-4782.md) +####### [Event 4793 S: The Password Policy Checking API was called.](auditing/event-4793.md) +###### [Audit Security Group Management](auditing/audit-security-group-management.md) +####### [Event 4731 S: A security-enabled local group was created.](auditing/event-4731.md) +####### [Event 4732 S: A member was added to a security-enabled local group.](auditing/event-4732.md) +####### [Event 4733 S: A member was removed from a security-enabled local group.](auditing/event-4733.md) +####### [Event 4734 S: A security-enabled local group was deleted.](auditing/event-4734.md) +####### [Event 4735 S: A security-enabled local group was changed.](auditing/event-4735.md) +####### [Event 4764 S: A group’s type was changed.](auditing/event-4764.md) +####### [Event 4799 S: A security-enabled local group membership was enumerated.](auditing/event-4799.md) +###### [Audit User Account Management](auditing/audit-user-account-management.md) +####### [Event 4720 S: A user account was created.](auditing/event-4720.md) +####### [Event 4722 S: A user account was enabled.](auditing/event-4722.md) +####### [Event 4723 S, F: An attempt was made to change an account's password.](auditing/event-4723.md) +####### [Event 4724 S, F: An attempt was made to reset an account's password.](auditing/event-4724.md) +####### [Event 4725 S: A user account was disabled.](auditing/event-4725.md) +####### [Event 4726 S: A user account was deleted.](auditing/event-4726.md) +####### [Event 4738 S: A user account was changed.](auditing/event-4738.md) +####### [Event 4740 S: A user account was locked out.](auditing/event-4740.md) +####### [Event 4765 S: SID History was added to an account.](auditing/event-4765.md) +####### [Event 4766 F: An attempt to add SID History to an account failed.](auditing/event-4766.md) +####### [Event 4767 S: A user account was unlocked.](auditing/event-4767.md) +####### [Event 4780 S: The ACL was set on accounts which are members of administrators groups.](auditing/event-4780.md) +####### [Event 4781 S: The name of an account was changed.](auditing/event-4781.md) +####### [Event 4794 S, F: An attempt was made to set the Directory Services Restore Mode administrator password.](auditing/event-4794.md) +####### [Event 4798 S: A user's local group membership was enumerated.](auditing/event-4798.md) +####### [Event 5376 S: Credential Manager credentials were backed up.](auditing/event-5376.md) +####### [Event 5377 S: Credential Manager credentials were restored from a backup.](auditing/event-5377.md) +###### [Audit DPAPI Activity](auditing/audit-dpapi-activity.md) +####### [Event 4692 S, F: Backup of data protection master key was attempted.](auditing/event-4692.md) +####### [Event 4693 S, F: Recovery of data protection master key was attempted.](auditing/event-4693.md) +####### [Event 4694 S, F: Protection of auditable protected data was attempted.](auditing/event-4694.md) +####### [Event 4695 S, F: Unprotection of auditable protected data was attempted.](auditing/event-4695.md) +###### [Audit PNP Activity](auditing/audit-pnp-activity.md) +####### [Event 6416 S: A new external device was recognized by the System.](auditing/event-6416.md) +####### [Event 6419 S: A request was made to disable a device.](auditing/event-6419.md) +####### [Event 6420 S: A device was disabled.](auditing/event-6420.md) +####### [Event 6421 S: A request was made to enable a device.](auditing/event-6421.md) +####### [Event 6422 S: A device was enabled.](auditing/event-6422.md) +####### [Event 6423 S: The installation of this device is forbidden by system policy.](auditing/event-6423.md) +####### [Event 6424 S: The installation of this device was allowed, after having previously been forbidden by policy.](auditing/event-6424.md) +###### [Audit Process Creation](auditing/audit-process-creation.md) +####### [Event 4688 S: A new process has been created.](auditing/event-4688.md) +####### [Event 4696 S: A primary token was assigned to process.](auditing/event-4696.md) +###### [Audit Process Termination](auditing/audit-process-termination.md) +####### [Event 4689 S: A process has exited.](auditing/event-4689.md) +###### [Audit RPC Events](auditing/audit-rpc-events.md) +####### [Event 5712 S: A Remote Procedure Call, RPC, was attempted.](auditing/event-5712.md) +###### [Audit Detailed Directory Service Replication](auditing/audit-detailed-directory-service-replication.md) +####### [Event 4928 S, F: An Active Directory replica source naming context was established.](auditing/event-4928.md) +####### [Event 4929 S, F: An Active Directory replica source naming context was removed.](auditing/event-4929.md) +####### [Event 4930 S, F: An Active Directory replica source naming context was modified.](auditing/event-4930.md) +####### [Event 4931 S, F: An Active Directory replica destination naming context was modified.](auditing/event-4931.md) +####### [Event 4934 S: Attributes of an Active Directory object were replicated.](auditing/event-4934.md) +####### [Event 4935 F: Replication failure begins.](auditing/event-4935.md) +####### [Event 4936 S: Replication failure ends.](auditing/event-4936.md) +####### [Event 4937 S: A lingering object was removed from a replica.](auditing/event-4937.md) +###### [Audit Directory Service Access](auditing/audit-directory-service-access.md) +####### [Event 4662 S, F: An operation was performed on an object.](auditing/event-4662.md) +####### [Event 4661 S, F: A handle to an object was requested.](auditing/event-4661.md) +###### [Audit Directory Service Changes](auditing/audit-directory-service-changes.md) +####### [Event 5136 S: A directory service object was modified.](auditing/event-5136.md) +####### [Event 5137 S: A directory service object was created.](auditing/event-5137.md) +####### [Event 5138 S: A directory service object was undeleted.](auditing/event-5138.md) +####### [Event 5139 S: A directory service object was moved.](auditing/event-5139.md) +####### [Event 5141 S: A directory service object was deleted.](auditing/event-5141.md) +###### [Audit Directory Service Replication](auditing/audit-directory-service-replication.md) +####### [Event 4932 S: Synchronization of a replica of an Active Directory naming context has begun.](auditing/event-4932.md) +####### [Event 4933 S, F: Synchronization of a replica of an Active Directory naming context has ended.](auditing/event-4933.md) +###### [Audit Account Lockout](auditing/audit-account-lockout.md) +####### [Event 4625 F: An account failed to log on.](auditing/event-4625.md) +###### [Audit User/Device Claims](auditing/audit-user-device-claims.md) +####### [Event 4626 S: User/Device claims information.](auditing/event-4626.md) +###### [Audit Group Membership](auditing/audit-group-membership.md) +####### [Event 4627 S: Group membership information.](auditing/event-4627.md) +###### [Audit IPsec Extended Mode](auditing/audit-ipsec-extended-mode.md) +###### [Audit IPsec Main Mode](auditing/audit-ipsec-main-mode.md) +###### [Audit IPsec Quick Mode](auditing/audit-ipsec-quick-mode.md) +###### [Audit Logoff](auditing/audit-logoff.md) +####### [Event 4634 S: An account was logged off.](auditing/event-4634.md) +####### [Event 4647 S: User initiated logoff.](auditing/event-4647.md) +###### [Audit Logon](auditing/audit-logon.md) +####### [Event 4624 S: An account was successfully logged on.](auditing/event-4624.md) +####### [Event 4625 F: An account failed to log on.](auditing/event-4625.md) +####### [Event 4648 S: A logon was attempted using explicit credentials.](auditing/event-4648.md) +####### [Event 4675 S: SIDs were filtered.](auditing/event-4675.md) +###### [Audit Network Policy Server](auditing/audit-network-policy-server.md) +###### [Audit Other Logon/Logoff Events](auditing/audit-other-logonlogoff-events.md) +####### [Event 4649 S: A replay attack was detected.](auditing/event-4649.md) +####### [Event 4778 S: A session was reconnected to a Window Station.](auditing/event-4778.md) +####### [Event 4779 S: A session was disconnected from a Window Station.](auditing/event-4779.md) +####### [Event 4800 S: The workstation was locked.](auditing/event-4800.md) +####### [Event 4801 S: The workstation was unlocked.](auditing/event-4801.md) +####### [Event 4802 S: The screen saver was invoked.](auditing/event-4802.md) +####### [Event 4803 S: The screen saver was dismissed.](auditing/event-4803.md) +####### [Event 5378 F: The requested credentials delegation was disallowed by policy.](auditing/event-5378.md) +####### [Event 5632 S, F: A request was made to authenticate to a wireless network.](auditing/event-5632.md) +####### [Event 5633 S, F: A request was made to authenticate to a wired network.](auditing/event-5633.md) +###### [Audit Special Logon](auditing/audit-special-logon.md) +####### [Event 4964 S: Special groups have been assigned to a new logon.](auditing/event-4964.md) +####### [Event 4672 S: Special privileges assigned to new logon.](auditing/event-4672.md) +###### [Audit Application Generated](auditing/audit-application-generated.md) +###### [Audit Certification Services](auditing/audit-certification-services.md) +###### [Audit Detailed File Share](auditing/audit-detailed-file-share.md) +####### [Event 5145 S, F: A network share object was checked to see whether client can be granted desired access.](auditing/event-5145.md) +###### [Audit File Share](auditing/audit-file-share.md) +####### [Event 5140 S, F: A network share object was accessed.](auditing/event-5140.md) +####### [Event 5142 S: A network share object was added.](auditing/event-5142.md) +####### [Event 5143 S: A network share object was modified.](auditing/event-5143.md) +####### [Event 5144 S: A network share object was deleted.](auditing/event-5144.md) +####### [Event 5168 F: SPN check for SMB/SMB2 failed.](auditing/event-5168.md) +###### [Audit File System](auditing/audit-file-system.md) +####### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) +####### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) +####### [Event 4660 S: An object was deleted.](auditing/event-4660.md) +####### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) +####### [Event 4664 S: An attempt was made to create a hard link.](auditing/event-4664.md) +####### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) +####### [Event 5051: A file was virtualized.](auditing/event-5051.md) +####### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) +###### [Audit Filtering Platform Connection](auditing/audit-filtering-platform-connection.md) +####### [Event 5031 F: The Windows Firewall Service blocked an application from accepting incoming connections on the network.](auditing/event-5031.md) +####### [Event 5150: The Windows Filtering Platform blocked a packet.](auditing/event-5150.md) +####### [Event 5151: A more restrictive Windows Filtering Platform filter has blocked a packet.](auditing/event-5151.md) +####### [Event 5154 S: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.](auditing/event-5154.md) +####### [Event 5155 F: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.](auditing/event-5155.md) +####### [Event 5156 S: The Windows Filtering Platform has permitted a connection.](auditing/event-5156.md) +####### [Event 5157 F: The Windows Filtering Platform has blocked a connection.](auditing/event-5157.md) +####### [Event 5158 S: The Windows Filtering Platform has permitted a bind to a local port.](auditing/event-5158.md) +####### [Event 5159 F: The Windows Filtering Platform has blocked a bind to a local port.](auditing/event-5159.md) +###### [Audit Filtering Platform Packet Drop](auditing/audit-filtering-platform-packet-drop.md) +####### [Event 5152 F: The Windows Filtering Platform blocked a packet.](auditing/event-5152.md) +####### [Event 5153 S: A more restrictive Windows Filtering Platform filter has blocked a packet.](auditing/event-5153.md) +###### [Audit Handle Manipulation](auditing/audit-handle-manipulation.md) +####### [Event 4690 S: An attempt was made to duplicate a handle to an object.](auditing/event-4690.md) +###### [Audit Kernel Object](auditing/audit-kernel-object.md) +####### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) +####### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) +####### [Event 4660 S: An object was deleted.](auditing/event-4660.md) +####### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) +###### [Audit Other Object Access Events](auditing/audit-other-object-access-events.md) +####### [Event 4671: An application attempted to access a blocked ordinal through the TBS.](auditing/event-4671.md) +####### [Event 4691 S: Indirect access to an object was requested.](auditing/event-4691.md) +####### [Event 5148 F: The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.](auditing/event-5148.md) +####### [Event 5149 F: The DoS attack has subsided and normal processing is being resumed.](auditing/event-5149.md) +####### [Event 4698 S: A scheduled task was created.](auditing/event-4698.md) +####### [Event 4699 S: A scheduled task was deleted.](auditing/event-4699.md) +####### [Event 4700 S: A scheduled task was enabled.](auditing/event-4700.md) +####### [Event 4701 S: A scheduled task was disabled.](auditing/event-4701.md) +####### [Event 4702 S: A scheduled task was updated.](auditing/event-4702.md) +####### [Event 5888 S: An object in the COM+ Catalog was modified.](auditing/event-5888.md) +####### [Event 5889 S: An object was deleted from the COM+ Catalog.](auditing/event-5889.md) +####### [Event 5890 S: An object was added to the COM+ Catalog.](auditing/event-5890.md) +###### [Audit Registry](auditing/audit-registry.md) +####### [Event 4663 S: An attempt was made to access an object.](auditing/event-4663.md) +####### [Event 4656 S, F: A handle to an object was requested.](auditing/event-4656.md) +####### [Event 4658 S: The handle to an object was closed.](auditing/event-4658.md) +####### [Event 4660 S: An object was deleted.](auditing/event-4660.md) +####### [Event 4657 S: A registry value was modified.](auditing/event-4657.md) +####### [Event 5039: A registry key was virtualized.](auditing/event-5039.md) +####### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) +###### [Audit Removable Storage](auditing/audit-removable-storage.md) +###### [Audit SAM](auditing/audit-sam.md) +####### [Event 4661 S, F: A handle to an object was requested.](auditing/event-4661.md) +###### [Audit Central Access Policy Staging](auditing/audit-central-access-policy-staging.md) +####### [Event 4818 S: Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy.](auditing/event-4818.md) +###### [Audit Audit Policy Change](auditing/audit-audit-policy-change.md) +####### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) +####### [Event 4715 S: The audit policy, SACL, on an object was changed.](auditing/event-4715.md) +####### [Event 4719 S: System audit policy was changed.](auditing/event-4719.md) +####### [Event 4817 S: Auditing settings on object were changed.](auditing/event-4817.md) +####### [Event 4902 S: The Per-user audit policy table was created.](auditing/event-4902.md) +####### [Event 4906 S: The CrashOnAuditFail value has changed.](auditing/event-4906.md) +####### [Event 4907 S: Auditing settings on object were changed.](auditing/event-4907.md) +####### [Event 4908 S: Special Groups Logon table modified.](auditing/event-4908.md) +####### [Event 4912 S: Per User Audit Policy was changed.](auditing/event-4912.md) +####### [Event 4904 S: An attempt was made to register a security event source.](auditing/event-4904.md) +####### [Event 4905 S: An attempt was made to unregister a security event source.](auditing/event-4905.md) +###### [Audit Authentication Policy Change](auditing/audit-authentication-policy-change.md) +####### [Event 4706 S: A new trust was created to a domain.](auditing/event-4706.md) +####### [Event 4707 S: A trust to a domain was removed.](auditing/event-4707.md) +####### [Event 4716 S: Trusted domain information was modified.](auditing/event-4716.md) +####### [Event 4713 S: Kerberos policy was changed.](auditing/event-4713.md) +####### [Event 4717 S: System security access was granted to an account.](auditing/event-4717.md) +####### [Event 4718 S: System security access was removed from an account.](auditing/event-4718.md) +####### [Event 4739 S: Domain Policy was changed.](auditing/event-4739.md) +####### [Event 4864 S: A namespace collision was detected.](auditing/event-4864.md) +####### [Event 4865 S: A trusted forest information entry was added.](auditing/event-4865.md) +####### [Event 4866 S: A trusted forest information entry was removed.](auditing/event-4866.md) +####### [Event 4867 S: A trusted forest information entry was modified.](auditing/event-4867.md) +###### [Audit Authorization Policy Change](auditing/audit-authorization-policy-change.md) +####### [Event 4703 S: A user right was adjusted.](auditing/event-4703.md) +####### [Event 4704 S: A user right was assigned.](auditing/event-4704.md) +####### [Event 4705 S: A user right was removed.](auditing/event-4705.md) +####### [Event 4670 S: Permissions on an object were changed.](auditing/event-4670.md) +####### [Event 4911 S: Resource attributes of the object were changed.](auditing/event-4911.md) +####### [Event 4913 S: Central Access Policy on the object was changed.](auditing/event-4913.md) +###### [Audit Filtering Platform Policy Change](auditing/audit-filtering-platform-policy-change.md) +###### [Audit MPSSVC Rule-Level Policy Change](auditing/audit-mpssvc-rule-level-policy-change.md) +####### [Event 4944 S: The following policy was active when the Windows Firewall started.](auditing/event-4944.md) +####### [Event 4945 S: A rule was listed when the Windows Firewall started.](auditing/event-4945.md) +####### [Event 4946 S: A change has been made to Windows Firewall exception list. A rule was added.](auditing/event-4946.md) +####### [Event 4947 S: A change has been made to Windows Firewall exception list. A rule was modified.](auditing/event-4947.md) +####### [Event 4948 S: A change has been made to Windows Firewall exception list. A rule was deleted.](auditing/event-4948.md) +####### [Event 4949 S: Windows Firewall settings were restored to the default values.](auditing/event-4949.md) +####### [Event 4950 S: A Windows Firewall setting has changed.](auditing/event-4950.md) +####### [Event 4951 F: A rule has been ignored because its major version number was not recognized by Windows Firewall.](auditing/event-4951.md) +####### [Event 4952 F: Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.](auditing/event-4952.md) +####### [Event 4953 F: Windows Firewall ignored a rule because it could not be parsed.](auditing/event-4953.md) +####### [Event 4954 S: Windows Firewall Group Policy settings have changed. The new settings have been applied.](auditing/event-4954.md) +####### [Event 4956 S: Windows Firewall has changed the active profile.](auditing/event-4956.md) +####### [Event 4957 F: Windows Firewall did not apply the following rule.](auditing/event-4957.md) +####### [Event 4958 F: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.](auditing/event-4958.md) +###### [Audit Other Policy Change Events](auditing/audit-other-policy-change-events.md) +####### [Event 4714 S: Encrypted data recovery policy was changed.](auditing/event-4714.md) +####### [Event 4819 S: Central Access Policies on the machine have been changed.](auditing/event-4819.md) +####### [Event 4826 S: Boot Configuration Data loaded.](auditing/event-4826.md) +####### [Event 4909: The local policy settings for the TBS were changed.](auditing/event-4909.md) +####### [Event 4910: The group policy settings for the TBS were changed.](auditing/event-4910.md) +####### [Event 5063 S, F: A cryptographic provider operation was attempted.](auditing/event-5063.md) +####### [Event 5064 S, F: A cryptographic context operation was attempted.](auditing/event-5064.md) +####### [Event 5065 S, F: A cryptographic context modification was attempted.](auditing/event-5065.md) +####### [Event 5066 S, F: A cryptographic function operation was attempted.](auditing/event-5066.md) +####### [Event 5067 S, F: A cryptographic function modification was attempted.](auditing/event-5067.md) +####### [Event 5068 S, F: A cryptographic function provider operation was attempted.](auditing/event-5068.md) +####### [Event 5069 S, F: A cryptographic function property operation was attempted.](auditing/event-5069.md) +####### [Event 5070 S, F: A cryptographic function property modification was attempted.](auditing/event-5070.md) +####### [Event 5447 S: A Windows Filtering Platform filter has been changed.](auditing/event-5447.md) +####### [Event 6144 S: Security policy in the group policy objects has been applied successfully.](auditing/event-6144.md) +####### [Event 6145 F: One or more errors occurred while processing security policy in the group policy objects.](auditing/event-6145.md) +###### [Audit Sensitive Privilege Use](auditing/audit-sensitive-privilege-use.md) +####### [Event 4673 S, F: A privileged service was called.](auditing/event-4673.md) +####### [Event 4674 S, F: An operation was attempted on a privileged object.](auditing/event-4674.md) +####### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) +###### [Audit Non Sensitive Privilege Use](auditing/audit-non-sensitive-privilege-use.md) +####### [Event 4673 S, F: A privileged service was called.](auditing/event-4673.md) +####### [Event 4674 S, F: An operation was attempted on a privileged object.](auditing/event-4674.md) +####### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) +###### [Audit Other Privilege Use Events](auditing/audit-other-privilege-use-events.md) +####### [Event 4985 S: The state of a transaction has changed.](auditing/event-4985.md) +###### [Audit IPsec Driver](auditing/audit-ipsec-driver.md) +###### [Audit Other System Events](auditing/audit-other-system-events.md) +####### [Event 5024 S: The Windows Firewall Service has started successfully.](auditing/event-5024.md) +####### [Event 5025 S: The Windows Firewall Service has been stopped.](auditing/event-5025.md) +####### [Event 5027 F: The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.](auditing/event-5027.md) +####### [Event 5028 F: The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.](auditing/event-5028.md) +####### [Event 5029 F: The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.](auditing/event-5029.md) +####### [Event 5030 F: The Windows Firewall Service failed to start.](auditing/event-5030.md) +####### [Event 5032 F: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.](auditing/event-5032.md) +####### [Event 5033 S: The Windows Firewall Driver has started successfully.](auditing/event-5033.md) +####### [Event 5034 S: The Windows Firewall Driver was stopped.](auditing/event-5034.md) +####### [Event 5035 F: The Windows Firewall Driver failed to start.](auditing/event-5035.md) +####### [Event 5037 F: The Windows Firewall Driver detected critical runtime error. Terminating.](auditing/event-5037.md) +####### [Event 5058 S, F: Key file operation.](auditing/event-5058.md) +####### [Event 5059 S, F: Key migration operation.](auditing/event-5059.md) +####### [Event 6400: BranchCache: Received an incorrectly formatted response while discovering availability of content.](auditing/event-6400.md) +####### [Event 6401: BranchCache: Received invalid data from a peer. Data discarded.](auditing/event-6401.md) +####### [Event 6402: BranchCache: The message to the hosted cache offering it data is incorrectly formatted.](auditing/event-6402.md) +####### [Event 6403: BranchCache: The hosted cache sent an incorrectly formatted response to the client.](auditing/event-6403.md) +####### [Event 6404: BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.](auditing/event-6404.md) +####### [Event 6405: BranchCache: %2 instances of event id %1 occurred.](auditing/event-6405.md) +####### [Event 6406: %1 registered to Windows Firewall to control filtering for the following: %2.](auditing/event-6406.md) +####### [Event 6407: 1%.](auditing/event-6407.md) +####### [Event 6408: Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.](auditing/event-6408.md) +####### [Event 6409: BranchCache: A service connection point object could not be parsed.](auditing/event-6409.md) +###### [Audit Security State Change](auditing/audit-security-state-change.md) +####### [Event 4608 S: Windows is starting up.](auditing/event-4608.md) +####### [Event 4616 S: The system time was changed.](auditing/event-4616.md) +####### [Event 4621 S: Administrator recovered system from CrashOnAuditFail.](auditing/event-4621.md) +###### [Audit Security System Extension](auditing/audit-security-system-extension.md) +####### [Event 4610 S: An authentication package has been loaded by the Local Security Authority.](auditing/event-4610.md) +####### [Event 4611 S: A trusted logon process has been registered with the Local Security Authority.](auditing/event-4611.md) +####### [Event 4614 S: A notification package has been loaded by the Security Account Manager.](auditing/event-4614.md) +####### [Event 4622 S: A security package has been loaded by the Local Security Authority.](auditing/event-4622.md) +####### [Event 4697 S: A service was installed in the system.](auditing/event-4697.md) +###### [Audit System Integrity](auditing/audit-system-integrity.md) +####### [Event 4612 S: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.](auditing/event-4612.md) +####### [Event 4615 S: Invalid use of LPC port.](auditing/event-4615.md) +####### [Event 4618 S: A monitored security event pattern has occurred.](auditing/event-4618.md) +####### [Event 4816 S: RPC detected an integrity violation while decrypting an incoming message.](auditing/event-4816.md) +####### [Event 5038 F: Code integrity determined that the image hash of a file is not valid.](auditing/event-5038.md) +####### [Event 5056 S: A cryptographic self-test was performed.](auditing/event-5056.md) +####### [Event 5062 S: A kernel-mode cryptographic self-test was performed.](auditing/event-5062.md) +####### [Event 5057 F: A cryptographic primitive operation failed.](auditing/event-5057.md) +####### [Event 5060 F: Verification operation failed.](auditing/event-5060.md) +####### [Event 5061 S, F: Cryptographic operation.](auditing/event-5061.md) +####### [Event 6281 F: Code Integrity determined that the page hashes of an image file are not valid.](auditing/event-6281.md) +####### [Event 6410 F: Code integrity determined that a file does not meet the security requirements to load into a process.](auditing/event-6410.md) +###### [Other Events](auditing/other-events.md) +####### [Event 1100 S: The event logging service has shut down.](auditing/event-1100.md) +####### [Event 1102 S: The audit log was cleared.](auditing/event-1102.md) +####### [Event 1104 S: The security log is now full.](auditing/event-1104.md) +####### [Event 1105 S: Event log automatic backup.](auditing/event-1105.md) +####### [Event 1108 S: The event logging service encountered an error while processing an incoming event published from %1.](auditing/event-1108.md) +###### [Appendix A: Security monitoring recommendations for many audit events](auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md) +###### [Registry (Global Object Access Auditing) ](auditing/registry-global-object-access-auditing.md) +###### [File System (Global Object Access Auditing) ](auditing/file-system-global-object-access-auditing.md) + + + + + +#### [Security policy settings](security-policy-settings/security-policy-settings.md) +#### [Administer security policy settings](security-policy-settings/administer-security-policy-settings.md) +##### [Network List Manager policies](security-policy-settings/network-list-manager-policies.md) +#### [Configure security policy settings](security-policy-settings/how-to-configure-security-policy-settings.md) +#### [Security policy settings reference](security-policy-settings/security-policy-settings-reference.md) +##### [Account Policies](security-policy-settings/account-policies.md) +###### [Password Policy](security-policy-settings/password-policy.md) +####### [Enforce password history](security-policy-settings/enforce-password-history.md) +####### [Maximum password age](security-policy-settings/maximum-password-age.md) +####### [Minimum password age](security-policy-settings/minimum-password-age.md) +####### [Minimum password length](security-policy-settings/minimum-password-length.md) +####### [Password must meet complexity requirements](security-policy-settings/password-must-meet-complexity-requirements.md) +####### [Store passwords using reversible encryption](security-policy-settings/store-passwords-using-reversible-encryption.md) +###### [Account Lockout Policy](security-policy-settings/account-lockout-policy.md) +####### [Account lockout duration](security-policy-settings/account-lockout-duration.md) +####### [Account lockout threshold](security-policy-settings/account-lockout-threshold.md) +####### [Reset account lockout counter after](security-policy-settings/reset-account-lockout-counter-after.md) +###### [Kerberos Policy](security-policy-settings/kerberos-policy.md) +####### [Enforce user logon restrictions](security-policy-settings/enforce-user-logon-restrictions.md) +####### [Maximum lifetime for service ticket](security-policy-settings/maximum-lifetime-for-service-ticket.md) +####### [Maximum lifetime for user ticket](security-policy-settings/maximum-lifetime-for-user-ticket.md) +####### [Maximum lifetime for user ticket renewal](security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md) +####### [Maximum tolerance for computer clock synchronization](security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md) +##### [Audit Policy](security-policy-settings/audit-policy.md) +##### [Security Options](security-policy-settings/security-options.md) +###### [Accounts: Administrator account status](security-policy-settings/accounts-administrator-account-status.md) +###### [Accounts: Block Microsoft accounts](security-policy-settings/accounts-block-microsoft-accounts.md) +###### [Accounts: Guest account status](security-policy-settings/accounts-guest-account-status.md) +###### [Accounts: Limit local account use of blank passwords to console logon only](security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md) +###### [Accounts: Rename administrator account](security-policy-settings/accounts-rename-administrator-account.md) +###### [Accounts: Rename guest account](security-policy-settings/accounts-rename-guest-account.md) +###### [Audit: Audit the access of global system objects](security-policy-settings/audit-audit-the-access-of-global-system-objects.md) +###### [Audit: Audit the use of Backup and Restore privilege](security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md) +###### [Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings](security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md) +###### [Audit: Shut down system immediately if unable to log security audits](security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md) +###### [DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax](security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md) +###### [DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax](security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md) +###### [Devices: Allow undock without having to log on](security-policy-settings/devices-allow-undock-without-having-to-log-on.md) +###### [Devices: Allowed to format and eject removable media](security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md) +###### [Devices: Prevent users from installing printer drivers](security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md) +###### [Devices: Restrict CD-ROM access to locally logged-on user only](security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md) +###### [Devices: Restrict floppy access to locally logged-on user only](security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md) +###### [Domain controller: Allow server operators to schedule tasks](security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md) +###### [Domain controller: LDAP server signing requirements](security-policy-settings/domain-controller-ldap-server-signing-requirements.md) +###### [Domain controller: Refuse machine account password changes](security-policy-settings/domain-controller-refuse-machine-account-password-changes.md) +###### [Domain member: Digitally encrypt or sign secure channel data (always)](security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) +###### [Domain member: Digitally encrypt secure channel data (when possible)](security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md) +###### [Domain member: Digitally sign secure channel data (when possible)](security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md) +###### [Domain member: Disable machine account password changes](security-policy-settings/domain-member-disable-machine-account-password-changes.md) +###### [Domain member: Maximum machine account password age](security-policy-settings/domain-member-maximum-machine-account-password-age.md) +###### [Domain member: Require strong (Windows 2000 or later) session key](security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md) +###### [Interactive logon: Display user information when the session is locked](security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md) +###### [Interactive logon: Don't display last signed-in](security-policy-settings/interactive-logon-do-not-display-last-user-name.md) +###### [Interactive logon: Don't display username at sign-in](security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md) +###### [Interactive logon: Do not require CTRL+ALT+DEL](security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md) +###### [Interactive logon: Machine account lockout threshold](security-policy-settings/interactive-logon-machine-account-lockout-threshold.md) +###### [Interactive logon: Machine inactivity limit](security-policy-settings/interactive-logon-machine-inactivity-limit.md) +###### [Interactive logon: Message text for users attempting to log on](security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md) +###### [Interactive logon: Message title for users attempting to log on](security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md) +###### [Interactive logon: Number of previous logons to cache (in case domain controller is not available)](security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md) +###### [Interactive logon: Prompt user to change password before expiration](security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md) +###### [Interactive logon: Require Domain Controller authentication to unlock workstation](security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md) +###### [Interactive logon: Require smart card](security-policy-settings/interactive-logon-require-smart-card.md) +###### [Interactive logon: Smart card removal behavior](security-policy-settings/interactive-logon-smart-card-removal-behavior.md) +###### [Microsoft network client: Digitally sign communications (always)](security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md) +###### [SMBv1 Microsoft network client: Digitally sign communications (always)](security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-always.md) +###### [SMBv1 Microsoft network client: Digitally sign communications (if server agrees)](security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees.md) +###### [Microsoft network client: Send unencrypted password to third-party SMB servers](security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md) +###### [Microsoft network server: Amount of idle time required before suspending session](security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md) +###### [Microsoft network server: Attempt S4U2Self to obtain claim information](security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md) +###### [Microsoft network server: Digitally sign communications (always)](security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md) +###### [SMBv1 Microsoft network server: Digitally sign communications (always)](security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md) +###### [SMBv1 Microsoft network server: Digitally sign communications (if client agrees)](security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md) +###### [Microsoft network server: Disconnect clients when logon hours expire](security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md) +###### [Microsoft network server: Server SPN target name validation level](security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md) +###### [Network access: Allow anonymous SID/Name translation](security-policy-settings/network-access-allow-anonymous-sidname-translation.md) +###### [Network access: Do not allow anonymous enumeration of SAM accounts](security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md) +###### [Network access: Do not allow anonymous enumeration of SAM accounts and shares](security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md) +###### [Network access: Do not allow storage of passwords and credentials for network authentication](security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md) +###### [Network access: Let Everyone permissions apply to anonymous users](security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md) +###### [Network access: Named Pipes that can be accessed anonymously](security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md) +###### [Network access: Remotely accessible registry paths](security-policy-settings/network-access-remotely-accessible-registry-paths.md) +###### [Network access: Remotely accessible registry paths and subpaths](security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md) +###### [Network access: Restrict anonymous access to Named Pipes and Shares](security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md) +###### [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md) +###### [Network access: Shares that can be accessed anonymously](security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md) +###### [Network access: Sharing and security model for local accounts](security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md) +###### [Network security: Allow Local System to use computer identity for NTLM](security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) +###### [Network security: Allow LocalSystem NULL session fallback](security-policy-settings/network-security-allow-localsystem-null-session-fallback.md) +###### [Network security: Allow PKU2U authentication requests to this computer to use online identities](security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md) +###### [Network security: Configure encryption types allowed for Kerberos Win7 only](security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md) +###### [Network security: Do not store LAN Manager hash value on next password change](security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md) +###### [Network security: Force logoff when logon hours expire](security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md) +###### [Network security: LAN Manager authentication level](security-policy-settings/network-security-lan-manager-authentication-level.md) +###### [Network security: LDAP client signing requirements](security-policy-settings/network-security-ldap-client-signing-requirements.md) +###### [Network security: Minimum session security for NTLM SSP based (including secure RPC) clients](security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md) +###### [Network security: Minimum session security for NTLM SSP based (including secure RPC) servers](security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md) +###### [Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication](security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md) +###### [Network security: Restrict NTLM: Add server exceptions in this domain](security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md) +###### [Network security: Restrict NTLM: Audit incoming NTLM traffic](security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md) +###### [Network security: Restrict NTLM: Audit NTLM authentication in this domain](security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md) +###### [Network security: Restrict NTLM: Incoming NTLM traffic](security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md) +###### [Network security: Restrict NTLM: NTLM authentication in this domain](security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md) +###### [Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers](security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) +###### [Recovery console: Allow automatic administrative logon](security-policy-settings/recovery-console-allow-automatic-administrative-logon.md) +###### [Recovery console: Allow floppy copy and access to all drives and folders](security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md) +###### [Shutdown: Allow system to be shut down without having to log on](security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md) +###### [Shutdown: Clear virtual memory pagefile](security-policy-settings/shutdown-clear-virtual-memory-pagefile.md) +###### [System cryptography: Force strong key protection for user keys stored on the computer](security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md) +###### [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md) +###### [System objects: Require case insensitivity for non-Windows subsystems](security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md) +###### [System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)](security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md) +###### [System settings: Optional subsystems](security-policy-settings/system-settings-optional-subsystems.md) +###### [System settings: Use certificate rules on Windows executables for Software Restriction Policies](security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md) +###### [User Account Control: Admin Approval Mode for the Built-in Administrator account](security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md) +###### [User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop](security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md) +###### [User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode](security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md) +###### [User Account Control: Behavior of the elevation prompt for standard users](security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md) +###### [User Account Control: Detect application installations and prompt for elevation](security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md) +###### [User Account Control: Only elevate executables that are signed and validated](security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md) +###### [User Account Control: Only elevate UIAccess applications that are installed in secure locations](security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md) +###### [User Account Control: Run all administrators in Admin Approval Mode](security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md) +###### [User Account Control: Switch to the secure desktop when prompting for elevation](security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md) +###### [User Account Control: Virtualize file and registry write failures to per-user locations](security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md) +##### [Advanced security audit policy settings](security-policy-settings/secpol-advanced-security-audit-policy-settings.md) +##### [User Rights Assignment](security-policy-settings/user-rights-assignment.md) +###### [Access Credential Manager as a trusted caller](security-policy-settings/access-credential-manager-as-a-trusted-caller.md) +###### [Access this computer from the network](security-policy-settings/access-this-computer-from-the-network.md) +###### [Act as part of the operating system](security-policy-settings/act-as-part-of-the-operating-system.md) +###### [Add workstations to domain](security-policy-settings/add-workstations-to-domain.md) +###### [Adjust memory quotas for a process](security-policy-settings/adjust-memory-quotas-for-a-process.md) +###### [Allow log on locally](security-policy-settings/allow-log-on-locally.md) +###### [Allow log on through Remote Desktop Services](security-policy-settings/allow-log-on-through-remote-desktop-services.md) +###### [Back up files and directories](security-policy-settings/back-up-files-and-directories.md) +###### [Bypass traverse checking](security-policy-settings/bypass-traverse-checking.md) +###### [Change the system time](security-policy-settings/change-the-system-time.md) +###### [Change the time zone](security-policy-settings/change-the-time-zone.md) +###### [Create a pagefile](security-policy-settings/create-a-pagefile.md) +###### [Create a token object](security-policy-settings/create-a-token-object.md) +###### [Create global objects](security-policy-settings/create-global-objects.md) +###### [Create permanent shared objects](security-policy-settings/create-permanent-shared-objects.md) +###### [Create symbolic links](security-policy-settings/create-symbolic-links.md) +###### [Debug programs](security-policy-settings/debug-programs.md) +###### [Deny access to this computer from the network](security-policy-settings/deny-access-to-this-computer-from-the-network.md) +###### [Deny log on as a batch job](security-policy-settings/deny-log-on-as-a-batch-job.md) +###### [Deny log on as a service](security-policy-settings/deny-log-on-as-a-service.md) +###### [Deny log on locally](security-policy-settings/deny-log-on-locally.md) +###### [Deny log on through Remote Desktop Services](security-policy-settings/deny-log-on-through-remote-desktop-services.md) +###### [Enable computer and user accounts to be trusted for delegation](security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md) +###### [Force shutdown from a remote system](security-policy-settings/force-shutdown-from-a-remote-system.md) +###### [Generate security audits](security-policy-settings/generate-security-audits.md) +###### [Impersonate a client after authentication](security-policy-settings/impersonate-a-client-after-authentication.md) +###### [Increase a process working set](security-policy-settings/increase-a-process-working-set.md) +###### [Increase scheduling priority](security-policy-settings/increase-scheduling-priority.md) +###### [Load and unload device drivers](security-policy-settings/load-and-unload-device-drivers.md) +###### [Lock pages in memory](security-policy-settings/lock-pages-in-memory.md) +###### [Log on as a batch job](security-policy-settings/log-on-as-a-batch-job.md) +###### [Log on as a service](security-policy-settings/log-on-as-a-service.md) +###### [Manage auditing and security log](security-policy-settings/manage-auditing-and-security-log.md) +###### [Modify an object label](security-policy-settings/modify-an-object-label.md) +###### [Modify firmware environment values](security-policy-settings/modify-firmware-environment-values.md) +###### [Perform volume maintenance tasks](security-policy-settings/perform-volume-maintenance-tasks.md) +###### [Profile single process](security-policy-settings/profile-single-process.md) +###### [Profile system performance](security-policy-settings/profile-system-performance.md) +###### [Remove computer from docking station](security-policy-settings/remove-computer-from-docking-station.md) +###### [Replace a process level token](security-policy-settings/replace-a-process-level-token.md) +###### [Restore files and directories](security-policy-settings/restore-files-and-directories.md) +###### [Shut down the system](security-policy-settings/shut-down-the-system.md) +###### [Synchronize directory service data](security-policy-settings/synchronize-directory-service-data.md) +###### [Take ownership of files or other objects](security-policy-settings/take-ownership-of-files-or-other-objects.md) + + + + + + +### [Windows security baselines](windows-security-baselines.md) +### [Security Compliance Toolkit](security-compliance-toolkit-10.md) +### [Get support](get-support-for-security-baselines.md) + +### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) + +## [Change history for Threat protection](change-history-for-threat-protection.md) From e0eb897ab6cbd9f4466035eb51f2ef711bd8a941 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 16:54:22 +0300 Subject: [PATCH 022/286] space --- windows/security/threat-protection/TOC.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index ee265a3955..2d87ec852a 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -4,7 +4,6 @@ - ## [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) ### [Get started](fake2.md) From 9da727de6eb8775273cada8b237d98dde235f73d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 17:06:02 +0300 Subject: [PATCH 023/286] trying dot --- .../security/threat-protection/windows-defender-atp/TOC.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 339a14435e..d371717aa8 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -1,9 +1,7 @@ - - # [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) -## [Get started](fake2.md) +## [Get started - latest one!!](./fake2.md) ### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) ### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) ### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) From 4e447fdb6226abcfd43e3eb0230e2b786ab3499a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 17:44:01 +0300 Subject: [PATCH 024/286] UPDATE 1 AND 2 --- windows/security/threat-protection/evaluate.md | 1 + windows/security/threat-protection/index.md | 2 +- .../security/threat-protection/windows-defender-atp/TOC.md | 4 ++-- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/evaluate.md b/windows/security/threat-protection/evaluate.md index e69de29bb2..078d53c466 100644 --- a/windows/security/threat-protection/evaluate.md +++ b/windows/security/threat-protection/evaluate.md @@ -0,0 +1 @@ +EVALUATE WDATP \ No newline at end of file diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 01cf2ddc25..9b47229867 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -34,7 +34,7 @@ Windows Defender ATP provides a security posture capability to help you dynamica Attack surface reduction | Next generation protection | Endpoint detection and response | Auto investigation | Security posture | Advanced hunting | Management and APIs | Microsoft threat protection :---|:---|:---|:---|:---|:---|:---|:--- -[Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview)

[Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

[Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

[Network firewall](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

[Attack surface reducation controls](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)| [Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)

[Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus) [Automated sandbox service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus)| [Alerts queue](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection)

[Historical endpoint data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection#machine-timeline)

[Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

[API and SIEM integration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

[Response orchestration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection)

[Forensic collection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection#collect-investigation-package-from-machines)

[Threat intelligence](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection)

[Advanced detonation and analysis service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#deep-analysis)

| [Automated investigation and remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)

[Threat remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#how-threats-are-remediated)

[Manage automated investigations](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#manage-automated-investigations)

[Analyze automated investigation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#analyze-automated-investigations)|[Asset inventory](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Recommended improvement actions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Secure score](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection)| [Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

Scheduled queries

Scheduled queries (Github)

[Custom TI](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection) | [Onboarding](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection)

[Configuration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection)

[Operating system baseline compliance](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[SIEM connectors](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

[Exposed APIs](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection)

[RBAC](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection)

[Reportin and trends](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection)| [Conditional access](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection)

O365 ATP

Azure ATP

Azure Security Center

Skype for Business

Cloud App Security +[Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview)

[Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

[Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

[Network firewall](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

[Attack surface reducation controls](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)| [Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)

[Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus) [Automated sandbox service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus)| [Alerts queue](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection)

[Historical endpoint data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection#machine-timeline)

[Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

[API and SIEM integration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

[Response orchestration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection)

[Forensic collection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection#collect-investigation-package-from-machines)

[Threat intelligence](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection)

[Advanced detonation and analysis service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#deep-analysis)

| [Automated investigation and remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)

[Threat remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#how-threats-are-remediated)

[Manage automated investigations](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#manage-automated-investigations)

[Analyze automated investigation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#analyze-automated-investigations)|[Asset inventory](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Recommended improvement actions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Secure score](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection)| [Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

Scheduled queries

Scheduled queries (Github)

[Custom TI](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection) | [Onboarding](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection)

[Configuration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection)

[Operating system baseline compliance](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[SIEM connectors](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

[Exposed APIs](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection)

[RBAC](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection)

[Reportin and trends](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection)| [Conditional access](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection)

[O365 ATP](integration.md)

[Azure ATP](integration.md)

[Azure Security Center](integration.md)

[Skype for Business](integration.md)

[Microsoft Cloud App Security](integration.md) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index d371717aa8..4d600535ce 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -10,8 +10,8 @@ ### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) -### [Evaluate Windows Defender ATP](threat-protection\evaluate.md) -#### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +### [Evaluate Windows Defender ATP - UPDATE1](../threat-protection/evaluate.md) +#### [Evaluate Attack surface reduction - ASR controls - UPDATE 2](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) #### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) #### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) #### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) From f08327944a4791c83dfb3836cf00834f06772a94 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 17:59:08 +0300 Subject: [PATCH 025/286] fixed links --- .../windows-defender-atp/TOC.md | 154 +++++++++--------- 1 file changed, 77 insertions(+), 77 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 4d600535ce..d7f7e67812 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -1,7 +1,7 @@ # [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) -## [Get started - latest one!!](./fake2.md) +## [Get started - FIXED!!](./fake2.md) ### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) ### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) ### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) @@ -10,18 +10,18 @@ ### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) -### [Evaluate Windows Defender ATP - UPDATE1](../threat-protection/evaluate.md) -#### [Evaluate Attack surface reduction - ASR controls - UPDATE 2](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) -#### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) -#### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) -#### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) -#### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) -#### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) -#### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) -#### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) +### [Evaluate Windows Defender ATP](../threat-protection/evaluate.md) +#### [Evaluate Attack surface reduction - ASR controls](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) +#### [Evaluate Exploit protection](../windows-defender-exploit-guard/evaluate-exploit-protection.md) +#### [Evaluate Network Protection](../windows-defender-exploit-guard/evaluate-network-protection.md) +#### [Evaluate Controlled folder access](../windows-defender-exploit-guard/evaluate-controlled-folder-access.md) +#### [Evaluate Windows Defender Antivirus protection](../windows-defender-antivirus/evaluate-windows-defender-antivirus.md) +#### [Evaluate Windows Defender Exploit Guard-rewrite](../windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md) +#### [Use auditing mode to evaluate Windows Defender Exploit Guard](../windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md) +#### [Testing scenarios using Windows Defender Application Guard in your business or organization](../windows-defender-application-guard//test-scenarios-wd-app-guard.md) -## [Onboard and configure machines to Windows Defender ATP](onboard.md) +## [Onboard and configure machines to Windows Defender ATP](./onboard.md) ### [Onboard machines - need to revise this page](onboard-configure-windows-defender-advanced-threat-protection.md) #### [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md) #### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) @@ -39,52 +39,52 @@ #### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) -###[Configure Attack surface reduction](configure1.md) -#### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) -#### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -#### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) +###[Configure Attack surface reduction](./configure1.md) +#### [System requirements for Windows Defender Application Guard](../windows-defender-application-guard//reqs-wd-app-guard.md) +#### [Prepare and install Windows Defender Application Guard](../windows-defender-application-guard//install-wd-app-guard.md) +#### [Configure the Group Policy settings for Windows Defender Application Guard](../windows-defender-application-guard//configure-wd-app-guard.md) -### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) -#### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) -#### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) -##### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) +### [Configure Next generation protection](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) +#### [Windows Defender AV on Windows Server 2016](../windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md) +#### [Windows Defender Antivirus compatibility](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md) +##### [Use limited periodic scanning in Windows Defender AV](../windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md) -#### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) -##### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) -###### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) -##### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) -###### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) -##### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) -###### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) -###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) -###### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) -###### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) -###### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) +#### [Deploy, manage updates, and report on Windows Defender Antivirus](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md) +##### [Deploy and enable Windows Defender Antivirus](../windows-defender-antivirus/deploy-windows-defender-antivirus.md) +###### [Deployment guide for VDI environments](../windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md) +##### [Report on Windows Defender Antivirus protection](../windows-defender-antivirus/report-monitor-windows-defender-antivirus.md) +###### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](../windows-defender-antivirus/troubleshoot-reporting.md) +##### [Manage updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md) +###### [Manage protection and definition updates](../windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md) +###### [Manage when protection updates should be downloaded and applied](../windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md) +###### [Manage updates for endpoints that are out of date](../windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md) +###### [Manage event-based forced updates](../windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md) +###### [Manage updates for mobile devices and VMs](../windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md) -#### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) -##### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md) -###### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) -##### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) -##### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md) -##### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md) -##### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md) -##### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) -##### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) -#### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) -#### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) -##### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) -##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) -##### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) -##### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) -##### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) +#### [Customize, initiate, and review the results of scans and remediation](../windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) +##### [Configure and validate exclusions in Windows Defender AV scans](../windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](../windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](../windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) +###### [Configure exclusions in Windows Defender AV on Windows Server 2016](../windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) +##### [Configure scanning options in Windows Defender AV](../windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) +##### [Configure remediation for scans](../windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) +##### [Configure scheduled scans](../windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) +##### [Configure and run scans](../windows-defender-antivirus/run-scan-windows-defender-antivirus.md) +##### [Review scan results](../windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) +##### [Run and review the results of a Windows Defender Offline scan](../windows-defender-antivirus/windows-defender-offline.md) +#### [Restore quarantined files in Windows Defender AV](../windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) +#### [Manage Windows Defender AV in your business](../windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) +##### [Use Group Policy settings to configure and manage Windows Defender AV](../windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) +##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](../windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) +##### [Use PowerShell cmdlets to configure and manage Windows Defender AV](../windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) +##### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](../windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) +##### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](../windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) -### [Configure Automatic investigation and remediation - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) +### [Configure Automatic investigation and remediation - needs new content, u can configure through the portal settings + link to the settings page](./configure3.md) ### [Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md) @@ -123,45 +123,45 @@ ### [Access the Windows Defender Security Center Community Center](community-windows-defender-advanced-threat-protection.md) -## [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) -### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) -#### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) -### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) +## [Attack surface reduction - Chris, Amitai, Justin](../windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) +### [Hardware based isolation](../windows-defender-application-guard//wd-app-guard-overview.md) +#### [Frequently Asked Questions - Windows Defender Application Guard](../windows-defender-application-guard//faq-wd-app-guard.md) +### [Windows Defender Application Control](../windows-defender-application-control/windows-defender-application-control.md) -### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) -#### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) +### [Exploit protection - Chris, Amitai, Justin](../windows-defender-exploit-guard/exploit-protection-exploit-guard.md) +#### [Comparison with Enhanced Mitigation Experience Toolkit](../windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md) -#### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) -#### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) +#### [Enable Exploit protection - Chris, Amitai, Justin](../windows-defender-exploit-guard/enable-exploit-protection.md) +#### [Customize Exploit protection](../windows-defender-exploit-guard/customize-exploit-protection.md) ##### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) -### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) +### [Network Protection](../windows-defender-exploit-guard/network-protection-exploit-guard.md) -#### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) -#### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) -### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) +#### [Enable Network Protection](../windows-defender-exploit-guard/enable-network-protection.md) +#### [Troubleshoot Network protection](../windows-defender-exploit-guard/troubleshoot-np.md) +### [Controlled folder access](../windows-defender-exploit-guard/controlled-folders-exploit-guard.md) -#### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) -#### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) +#### [Enable Controlled folder access](../windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md) +#### [Customize Controlled folder access](../windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md) -#### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) -#### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) -#### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) +#### [Enable Attack surface reduction](../windows-defender-exploit-guard/enable-attack-surface-reduction.md) +#### [Customize Attack surface reduction](../windows-defender-exploit-guard/customize-attack-surface-reduction.md) +#### [Troubleshoot Attack surface reduction rules](../windows-defender-exploit-guard/troubleshoot-asr.md) -## [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) -### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -#### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) -#### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) -#### [Configure and validate network connections](windows-defender-antivirus\configure-network-connections-windows-defender-antivirus.md) -#### [Enable the Block at First Sight feature](windows-defender-antivirus\configure-block-at-first-sight-windows-defender-antivirus.md) -#### [Configure the cloud block timeout period](windows-defender-antivirus\configure-cloud-block-timeout-period-windows-defender-antivirus.md) -### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus\configure-protection-features-windows-defender-antivirus.md) -#### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus\detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) -#### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md) +## [Next gen protection - Andrea, Chris, Amitai](../windows-defender-antivirus/configure-windows-defender-antivirus-features.md) +### [Utilize Microsoft cloud-delivered protection](../windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +#### [Enable cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) +#### [Specify the cloud-delivered protection level](../windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md) +#### [Configure and validate network connections](../windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md) +#### [Enable the Block at First Sight feature](../windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md) +#### [Configure the cloud block timeout period](../windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md) +### [Configure behavioral, heuristic, and real-time protection](../windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md) +#### [Detect and block Potentially Unwanted Applications](../windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) +#### [Enable and configure always-on protection and monitoring](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) ## [Endpoint detection and response - Tomer B.](faketopic.md) @@ -320,7 +320,7 @@ ##Troubleshoot Windows Defender ATP -### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) +### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](../windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md) ###Troubleshoot sensor state - Ask Heike name of sensor From 45af70e12accf92f6e19c43b14421ffbbb0fd9d7 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 18:20:39 +0300 Subject: [PATCH 026/286] fix links --- .../windows-defender-atp/TOC.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index d7f7e67812..5b3dda6b8a 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -10,7 +10,7 @@ ### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) -### [Evaluate Windows Defender ATP](../threat-protection/evaluate.md) +### [Evaluate Windows Defender ATP](./evaluate.md) #### [Evaluate Attack surface reduction - ASR controls](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) #### [Evaluate Exploit protection](../windows-defender-exploit-guard/evaluate-exploit-protection.md) #### [Evaluate Network Protection](../windows-defender-exploit-guard/evaluate-network-protection.md) @@ -21,7 +21,7 @@ #### [Testing scenarios using Windows Defender Application Guard in your business or organization](../windows-defender-application-guard//test-scenarios-wd-app-guard.md) -## [Onboard and configure machines to Windows Defender ATP](./onboard.md) +## [Onboard and configure machines to Windows Defender ATP](../threat-protection/onboard.md) ### [Onboard machines - need to revise this page](onboard-configure-windows-defender-advanced-threat-protection.md) #### [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md) #### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) @@ -134,7 +134,7 @@ #### [Enable Exploit protection - Chris, Amitai, Justin](../windows-defender-exploit-guard/enable-exploit-protection.md) #### [Customize Exploit protection](../windows-defender-exploit-guard/customize-exploit-protection.md) -##### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) +##### [Import, export, and deploy Exploit protection configurations](../windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) ### [Network Protection](../windows-defender-exploit-guard/network-protection-exploit-guard.md) @@ -164,7 +164,7 @@ #### [Enable and configure always-on protection and monitoring](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) -## [Endpoint detection and response - Tomer B.](faketopic.md) +## [Endpoint detection and response - Tomer B.](../threat-protection/faketopic.md) ###Alerts queue #### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) #### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) @@ -222,7 +222,7 @@ ### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) -## [Management and APIs](management-apis.md) +## [Management and APIs](./management-apis.md) ### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md) #### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) #### [Configure Splunk to pull alerts](configure-splunk-windows-defender-advanced-threat-protection.md) @@ -306,16 +306,16 @@ #### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) -### [Reporting](reporting.md) +### [Reporting](../threat-protection/reporting.md) #### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) -### [Permissions](permissions.md) +### [Permissions](../threat-protection/permissions.md) #### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md) #### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) -## [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](integration.md) +## [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](../threat-protection/integration.md) ### [Protect users, data, and devices with conditional access](conditional-access-windows-defender-advanced-threat-protection.md) From 4554a5d39cc523c28e15a3f1ec876427aa94884e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 20:56:39 +0300 Subject: [PATCH 027/286] fix links --- .../windows-defender-atp/TOC.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 5b3dda6b8a..3e31b3548e 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -10,7 +10,7 @@ ### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) -### [Evaluate Windows Defender ATP](./evaluate.md) +### [Evaluate Windows Defender ATP](../evaluate.md) #### [Evaluate Attack surface reduction - ASR controls](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) #### [Evaluate Exploit protection](../windows-defender-exploit-guard/evaluate-exploit-protection.md) #### [Evaluate Network Protection](../windows-defender-exploit-guard/evaluate-network-protection.md) @@ -21,7 +21,7 @@ #### [Testing scenarios using Windows Defender Application Guard in your business or organization](../windows-defender-application-guard//test-scenarios-wd-app-guard.md) -## [Onboard and configure machines to Windows Defender ATP](../threat-protection/onboard.md) +## [Onboard and configure machines to Windows Defender ATP](../onboard.md) ### [Onboard machines - need to revise this page](onboard-configure-windows-defender-advanced-threat-protection.md) #### [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md) #### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) @@ -39,7 +39,7 @@ #### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) -###[Configure Attack surface reduction](./configure1.md) +###[Configure Attack surface reduction](../configure1.md) #### [System requirements for Windows Defender Application Guard](../windows-defender-application-guard//reqs-wd-app-guard.md) #### [Prepare and install Windows Defender Application Guard](../windows-defender-application-guard//install-wd-app-guard.md) #### [Configure the Group Policy settings for Windows Defender Application Guard](../windows-defender-application-guard//configure-wd-app-guard.md) @@ -84,7 +84,7 @@ ##### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](../windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) -### [Configure Automatic investigation and remediation - needs new content, u can configure through the portal settings + link to the settings page](./configure3.md) +### [Configure Automatic investigation and remediation - needs new content, u can configure through the portal settings + link to the settings page](../configure3.md) ### [Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md) @@ -164,7 +164,7 @@ #### [Enable and configure always-on protection and monitoring](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) -## [Endpoint detection and response - Tomer B.](../threat-protection/faketopic.md) +## [Endpoint detection and response - Tomer B.](../faketopic.md) ###Alerts queue #### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) #### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) @@ -222,7 +222,7 @@ ### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) -## [Management and APIs](./management-apis.md) +## [Management and APIs](../management-apis.md) ### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md) #### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) #### [Configure Splunk to pull alerts](configure-splunk-windows-defender-advanced-threat-protection.md) @@ -306,16 +306,16 @@ #### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) -### [Reporting](../threat-protection/reporting.md) +### [Reporting](../reporting.md) #### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) -### [Permissions](../threat-protection/permissions.md) +### [Permissions](../permissions.md) #### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md) #### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) -## [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](../threat-protection/integration.md) +## [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](../integration.md) ### [Protect users, data, and devices with conditional access](conditional-access-windows-defender-advanced-threat-protection.md) From 608f477240922a983c19fe229bd667c5285c5a6e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 31 Jul 2018 21:12:28 +0300 Subject: [PATCH 028/286] minor --- .../security/threat-protection/windows-defender-atp/TOC.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 3e31b3548e..ebe07a26c7 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -1,7 +1,7 @@ # [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) -## [Get started - FIXED!!](./fake2.md) +## [Get started](../fake2.md) ### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) ### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) ### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) @@ -129,10 +129,10 @@ ### [Windows Defender Application Control](../windows-defender-application-control/windows-defender-application-control.md) -### [Exploit protection - Chris, Amitai, Justin](../windows-defender-exploit-guard/exploit-protection-exploit-guard.md) +### [Exploit protection - Chris, Amitai, Andrea](../windows-defender-exploit-guard/exploit-protection-exploit-guard.md) #### [Comparison with Enhanced Mitigation Experience Toolkit](../windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md) -#### [Enable Exploit protection - Chris, Amitai, Justin](../windows-defender-exploit-guard/enable-exploit-protection.md) +#### [Enable Exploit protection](../windows-defender-exploit-guard/enable-exploit-protection.md) #### [Customize Exploit protection](../windows-defender-exploit-guard/customize-exploit-protection.md) ##### [Import, export, and deploy Exploit protection configurations](../windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) From 11694188c984eee73f8ddf914ca9069ac16d6a21 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 1 Aug 2018 09:36:38 +0300 Subject: [PATCH 029/286] remove wdatp table --- windows/security/index.yml | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index c06e4aad88..838003bb6b 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -78,17 +78,3 @@ sections: title: Information protection -- title: Windows Defender Advanced Threat Protection - items: - - type: markdown - text: " - Prevent, detect, investigate, and respond to advanced threats. The following capabilities are available across multiple products that make up the Windows Defender ATP platform. -
 
-
Attack surface reductionNext generation protectionEndpoint detection and responseAuto investigation and remediationSecurity posture
[Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows)

[Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

[Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

[Device restrictions](https://docs.microsoft.com/en-us/intune/device-restrictions-configure)

[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

[Network firewall](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

[Attack surface reduction controls](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)
[Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview)

[Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

[Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

[Device restrictions](https://docs.microsoft.com/en-us/intune/device-restrictions-configure)

[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

[Network firewall](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

[Attack surface reduction controls](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)
[Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)

[Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus)

[Automated sandbox service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus)
[Alerts queue](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection)

[Historical endpoint data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection#machine-timeline)

[Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

[API and SIEM integration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

[Response orchestration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection)

[Forensic collection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection#collect-investigation-package-from-machines)

[Threat intelligence](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection)

[Advanced detonation and analysis service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#deep-analysis)
[Automated investigation and remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)

[Threat remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#how-threats-are-remediated)

[Manage automated investigations](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#manage-automated-investigations)

[Analyze automated investigation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#analyze-automated-investigations)
- - - - - - -
Attack surface reductionNext generation protectionEndpoint detection and responseAuto investigation and remediationSecurity posture
[Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview)

[Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

[Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

[Device restrictions](https://docs.microsoft.com/en-us/intune/device-restrictions-configure)

[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

[Network firewall](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

[Attack surface reduction controls](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)
[Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)

[Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus)

[Automated sandbox service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus)
[Alerts queue](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection)

[Historical endpoint data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection#machine-timeline)

[Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

[API and SIEM integration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

[Response orchestration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection)

[Forensic collection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection#collect-investigation-package-from-machines)

[Threat intelligence](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection)

[Advanced detonation and analysis service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#deep-analysis)
[Automated investigation and remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)

[Threat remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#how-threats-are-remediated)

[Manage automated investigations](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#manage-automated-investigations)

[Analyze automated investigation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#analyze-automated-investigations)
[Asset inventory](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Operating system baseline compliance](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Recommended improvement actions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Secure score](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

[Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection)

[Reporting and trends](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection)
" \ No newline at end of file From a792b2f37ef67fa7ba5b49c4fdc217b1be24190a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 2 Aug 2018 14:27:23 +0300 Subject: [PATCH 030/286] changes --- windows/security/threat-protection/TOC.md | 4 ++-- windows/security/threat-protection/integration.md | 13 +++++++++++-- .../security/threat-protection/management-apis.md | 4 +++- windows/security/threat-protection/onboard.md | 7 ++++++- .../threat-protection/windows-defender-atp/TOC.md | 3 --- 5 files changed, 22 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 133098b7c0..320952520f 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -6,7 +6,7 @@ ## [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) -### [Get started](fake2.md) +###Get started #### [Minimum requirements](windows-defender-atp\minimum-requirements-windows-defender-advanced-threat-protection.md) #### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md) #### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) @@ -14,7 +14,7 @@ #### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) -#### [Evaluate Windows Defender ATP](evaluate.md) +####Evaluate Windows Defender ATP ##### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) ##### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) ##### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) diff --git a/windows/security/threat-protection/integration.md b/windows/security/threat-protection/integration.md index 6c22bd96e1..556bd4ad30 100644 --- a/windows/security/threat-protection/integration.md +++ b/windows/security/threat-protection/integration.md @@ -13,8 +13,17 @@ ms.localizationpriority: high ms.date: 07/01/2018 --- -# TO do: Heike, Alon, or Raviv +# TO do: Tomer, Alon, or Raviv These are all the products that WDATP integrates with then link to their documentation. -Have links to the different configuration settings and put links there. \ No newline at end of file +Have links to the different configuration settings and put links there. + + +Micorosft works better togegerthr + +when you integrate ms products you get btter protection + +here's the list of products that work well with WDATP. + +for each one, have a line or two. \ No newline at end of file diff --git a/windows/security/threat-protection/management-apis.md b/windows/security/threat-protection/management-apis.md index 44ff4dfc98..14fe32f3c1 100644 --- a/windows/security/threat-protection/management-apis.md +++ b/windows/security/threat-protection/management-apis.md @@ -23,4 +23,6 @@ wdatp allows you to interact with the platform and other systems enable to manage and interact with the system -APIs, SIEM connectors, Reporting, powerbi, etc \ No newline at end of file +APIs, SIEM connectors, Reporting, powerbi, etc + +## In this section \ No newline at end of file diff --git a/windows/security/threat-protection/onboard.md b/windows/security/threat-protection/onboard.md index f9ac29a1f8..fedfea7f4f 100644 --- a/windows/security/threat-protection/onboard.md +++ b/windows/security/threat-protection/onboard.md @@ -13,4 +13,9 @@ ms.localizationpriority: high ms.date: 07/01/2018 --- -# TO do: naama and joey to write this topic \ No newline at end of file +# Onboard and configure machines to Windows Defender ATP + +Onboard to the sensor, configure the indivual capabilities in Windows Defender ATP. + +## In this section +table for configure to the parent nodes for each \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index ebe07a26c7..7ad06daaa2 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -84,9 +84,6 @@ ##### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](../windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) -### [Configure Automatic investigation and remediation - needs new content, u can configure through the portal settings + link to the settings page](../configure3.md) - - ### [Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md) ####General ##### [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md) From 956da009f8250e1cb7a6ce5402711176d31f66cb Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 2 Aug 2018 15:13:37 +0000 Subject: [PATCH 031/286] Merged PR 10302: Fixing contextual ToC --- .../windows-defender-antivirus/{TOC.md => oldTOC.md} | 0 .../windows-defender-application-control/{TOC.md => oldTOC.md} | 0 .../windows-defender-exploit-guard/{TOC.md => oldTOC.md} | 0 .../windows-defender-security-center/{TOC.md => oldTOC.md} | 0 4 files changed, 0 insertions(+), 0 deletions(-) rename windows/security/threat-protection/windows-defender-antivirus/{TOC.md => oldTOC.md} (100%) rename windows/security/threat-protection/windows-defender-application-control/{TOC.md => oldTOC.md} (100%) rename windows/security/threat-protection/windows-defender-exploit-guard/{TOC.md => oldTOC.md} (100%) rename windows/security/threat-protection/windows-defender-security-center/{TOC.md => oldTOC.md} (100%) diff --git a/windows/security/threat-protection/windows-defender-antivirus/TOC.md b/windows/security/threat-protection/windows-defender-antivirus/oldTOC.md similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/TOC.md rename to windows/security/threat-protection/windows-defender-antivirus/oldTOC.md diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/oldTOC.md similarity index 100% rename from windows/security/threat-protection/windows-defender-application-control/TOC.md rename to windows/security/threat-protection/windows-defender-application-control/oldTOC.md diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/TOC.md b/windows/security/threat-protection/windows-defender-exploit-guard/oldTOC.md similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/TOC.md rename to windows/security/threat-protection/windows-defender-exploit-guard/oldTOC.md diff --git a/windows/security/threat-protection/windows-defender-security-center/TOC.md b/windows/security/threat-protection/windows-defender-security-center/oldTOC.md similarity index 100% rename from windows/security/threat-protection/windows-defender-security-center/TOC.md rename to windows/security/threat-protection/windows-defender-security-center/oldTOC.md From 94d698d1ed5f58a260ef3534ecb114b1b26ea83d Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 2 Aug 2018 16:25:50 -0700 Subject: [PATCH 032/286] fixing ASR toc --- windows/security/threat-protection/TOC.md | 45 +++++++++++------- ...ices-to-the-membership-group-for-a-zone.md | 0 ...ices-to-the-membership-group-for-a-zone.md | 0 ...e-files-for-settings-used-in-this-guide.md | 0 ...ssign-security-group-filters-to-the-gpo.md | 0 .../basic-firewall-policy-design.md | 0 .../windows-firewall/boundary-zone-gpos.md | 0 .../windows-firewall/boundary-zone.md | 0 ...e-based-isolation-policy-design-example.md | 0 ...rtificate-based-isolation-policy-design.md | 0 ...ange-rules-from-request-to-require-mode.md | 0 ...ist-configuring-basic-firewall-settings.md | 0 ...uring-rules-for-an-isolated-server-zone.md | 0 ...rs-in-a-standalone-isolated-server-zone.md | 0 ...configuring-rules-for-the-boundary-zone.md | 0 ...nfiguring-rules-for-the-encryption-zone.md | 0 ...nfiguring-rules-for-the-isolated-domain.md | 0 ...checklist-creating-group-policy-objects.md | 0 ...ecklist-creating-inbound-firewall-rules.md | 0 ...cklist-creating-outbound-firewall-rules.md | 0 ...ts-of-a-standalone-isolated-server-zone.md | 0 ...ementing-a-basic-firewall-policy-design.md | 0 ...rtificate-based-isolation-policy-design.md | 0 ...enting-a-domain-isolation-policy-design.md | 0 ...andalone-server-isolation-policy-design.md | 0 .../configure-authentication-methods.md | 0 ...ure-data-protection-quick-mode-settings.md | 0 ...y-to-autoenroll-and-deploy-certificates.md | 0 ...nfigure-key-exchange-main-mode-settings.md | 0 ...nfigure-the-rules-to-require-encryption.md | 0 .../configure-the-windows-firewall-log.md | 0 ...ion-authentication-certificate-template.md | 0 ...notifications-when-a-program-is-blocked.md | 0 ...hat-certificates-are-deployed-correctly.md | 0 .../copy-a-gpo-to-create-a-new-gpo.md | 0 ...ate-a-group-account-in-active-directory.md | 0 .../create-a-group-policy-object.md | 0 ...e-an-authentication-exemption-list-rule.md | 0 .../create-an-authentication-request-rule.md | 0 .../create-an-inbound-icmp-rule.md | 0 .../create-an-inbound-port-rule.md | 0 ...eate-an-inbound-program-or-service-rule.md | 0 .../create-an-outbound-port-rule.md | 0 ...ate-an-outbound-program-or-service-rule.md | 0 .../create-inbound-rules-to-support-rpc.md | 0 .../create-wmi-filters-for-the-gpo.md | 0 ...irewall-with-advanced-security-strategy.md | 0 ...ining-the-trusted-state-of-your-devices.md | 0 .../windows-firewall/documenting-the-zones.md | 0 .../domain-isolation-policy-design-example.md | 0 .../domain-isolation-policy-design.md | 0 .../enable-predefined-inbound-rules.md | 0 .../enable-predefined-outbound-rules.md | 0 .../windows-firewall/encryption-zone-gpos.md | 0 .../windows-firewall/encryption-zone.md | 0 ...-with-advanced-security-design-examples.md | 0 .../exempt-icmp-from-authentication.md | 0 .../windows-firewall/exemption-list.md | 0 .../windows-firewall/firewall-gpos.md | 0 .../firewall-policy-design-example.md | 0 ...-about-your-active-directory-deployment.md | 0 ...out-your-current-network-infrastructure.md | 0 ...athering-information-about-your-devices.md | 0 .../gathering-other-relevant-information.md | 0 .../gathering-the-information-you-need.md | 0 .../windows-firewall/gpo-domiso-boundary.md | 0 .../windows-firewall/gpo-domiso-encryption.md | 0 .../windows-firewall/gpo-domiso-firewall.md | 0 .../gpo-domiso-isolateddomain-clients.md | 0 .../gpo-domiso-isolateddomain-servers.md | 0 ...with-advanced-security-deployment-goals.md | 0 .../windows-firewall/images/corpnet.gif | Bin .../images/createipsecrule.gif | Bin .../images/powershelllogosmall.gif | Bin .../windows-firewall/images/qmcryptoset.gif | Bin .../images/wfas-design2example1.gif | Bin .../images/wfas-design3example1.gif | Bin .../images/wfas-designexample1.gif | Bin .../images/wfas-designflowchart1.gif | Bin .../images/wfas-domainiso.gif | Bin .../images/wfas-domainisoencrypt.gif | Bin .../images/wfas-domainisohighsec.gif | Bin .../images/wfas-domainnag.gif | Bin .../images/wfas-icon-checkbox.gif | Bin .../images/wfas-implement.gif | Bin .../images/wfasdomainisoboundary.gif | Bin ...wall-with-advanced-security-design-plan.md | 0 .../windows-firewall/isolated-domain-gpos.md | 0 .../windows-firewall/isolated-domain.md | 0 .../isolating-apps-on-your-network.md | 0 .../link-the-gpo-to-the-domain.md | 0 ...-firewall-with-advanced-security-design.md | 0 ...-a-different-zone-or-version-of-windows.md | 0 ...agement-console-to-ip-security-policies.md | 0 ...windows-firewall-with-advanced-security.md | 0 ...-management-console-to-windows-firewall.md | 0 ...windows-firewall-with-advanced-security.md | 0 ...anning-certificate-based-authentication.md | 0 .../planning-domain-isolation-zones.md | 0 .../planning-gpo-deployment.md | 0 ...icy-deployment-for-your-isolation-zones.md | 0 ...planning-isolation-groups-for-the-zones.md | 0 .../planning-network-access-groups.md | 0 .../planning-server-isolation-zones.md | 0 ...ng-settings-for-a-basic-firewall-policy.md | 0 .../windows-firewall/planning-the-gpos.md | 0 ...windows-firewall-with-advanced-security.md | 0 ...-firewall-with-advanced-security-design.md | 0 .../procedures-used-in-this-guide.md | 0 ...t-devices-from-unwanted-network-traffic.md | 0 ...n-accessing-sensitive-network-resources.md | 0 ...cess-to-only-specified-users-or-devices.md | 0 ...restrict-access-to-only-trusted-devices.md | 0 ...erver-access-to-members-of-a-group-only.md | 0 ...to-end-ipsec-connections-by-using-ikev2.md | 0 .../windows-firewall/server-isolation-gpos.md | 0 .../server-isolation-policy-design-example.md | 0 .../server-isolation-policy-design.md | 0 ...firewall-and-configure-default-behavior.md | 0 ...l-with-advanced-security-design-process.md | 0 ...y-that-network-traffic-is-authenticated.md | 0 ...-administration-with-windows-powershell.md | 0 ...with-advanced-security-deployment-guide.md | 0 ...all-with-advanced-security-design-guide.md | 0 ...windows-firewall-with-advanced-security.md | 0 125 files changed, 29 insertions(+), 16 deletions(-) rename windows/security/{identity-protection => threat-protection}/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/assign-security-group-filters-to-the-gpo.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/basic-firewall-policy-design.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/boundary-zone-gpos.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/boundary-zone.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/certificate-based-isolation-policy-design-example.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/certificate-based-isolation-policy-design.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/change-rules-from-request-to-require-mode.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-configuring-basic-firewall-settings.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-creating-group-policy-objects.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-creating-inbound-firewall-rules.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-creating-outbound-firewall-rules.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/configure-authentication-methods.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/configure-data-protection-quick-mode-settings.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/configure-key-exchange-main-mode-settings.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/configure-the-rules-to-require-encryption.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/configure-the-windows-firewall-log.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/configure-the-workstation-authentication-certificate-template.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/confirm-that-certificates-are-deployed-correctly.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/create-a-group-account-in-active-directory.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/create-a-group-policy-object.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/create-an-authentication-exemption-list-rule.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/create-an-authentication-request-rule.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/create-an-inbound-icmp-rule.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/create-an-inbound-port-rule.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/create-an-inbound-program-or-service-rule.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/create-an-outbound-port-rule.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/create-an-outbound-program-or-service-rule.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/create-inbound-rules-to-support-rpc.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/create-wmi-filters-for-the-gpo.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/determining-the-trusted-state-of-your-devices.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/documenting-the-zones.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/domain-isolation-policy-design-example.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/domain-isolation-policy-design.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/enable-predefined-inbound-rules.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/enable-predefined-outbound-rules.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/encryption-zone-gpos.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/encryption-zone.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/exempt-icmp-from-authentication.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/exemption-list.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/firewall-gpos.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/firewall-policy-design-example.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/gathering-information-about-your-active-directory-deployment.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/gathering-information-about-your-current-network-infrastructure.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/gathering-information-about-your-devices.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/gathering-other-relevant-information.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/gathering-the-information-you-need.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/gpo-domiso-boundary.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/gpo-domiso-encryption.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/gpo-domiso-firewall.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/gpo-domiso-isolateddomain-clients.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/gpo-domiso-isolateddomain-servers.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/corpnet.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/createipsecrule.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/powershelllogosmall.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/qmcryptoset.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/wfas-design2example1.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/wfas-design3example1.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/wfas-designexample1.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/wfas-designflowchart1.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/wfas-domainiso.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/wfas-domainisoencrypt.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/wfas-domainisohighsec.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/wfas-domainnag.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/wfas-icon-checkbox.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/wfas-implement.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/images/wfasdomainisoboundary.gif (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/isolated-domain-gpos.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/isolated-domain.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/isolating-apps-on-your-network.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/link-the-gpo-to-the-domain.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/open-windows-firewall-with-advanced-security.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/planning-certificate-based-authentication.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/planning-domain-isolation-zones.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/planning-gpo-deployment.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/planning-isolation-groups-for-the-zones.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/planning-network-access-groups.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/planning-server-isolation-zones.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/planning-settings-for-a-basic-firewall-policy.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/planning-the-gpos.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/procedures-used-in-this-guide.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/protect-devices-from-unwanted-network-traffic.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/restrict-access-to-only-specified-users-or-devices.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/restrict-access-to-only-trusted-devices.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/restrict-server-access-to-members-of-a-group-only.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/server-isolation-gpos.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/server-isolation-policy-design-example.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/server-isolation-policy-design.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/verify-that-network-traffic-is-authenticated.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/windows-firewall-with-advanced-security-design-guide.md (100%) rename windows/security/{identity-protection => threat-protection}/windows-firewall/windows-firewall-with-advanced-security.md (100%) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 320952520f..d20ee0b3ef 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -149,32 +149,45 @@ ### [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) -#### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) +#### [Hardware-based isolation](windows-defender-application-guard/wd-app-guard-overview.md) ##### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) -#### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) +#### [Application Control](windows-defender-application-control/windows-defender-application-control.md) +##### [Design](windows-defender-application-control/windows-defender-application-control-design-guide.md) +##### [Deploy](windows-defender-application-control/windows-defender-application-control-deployment-guide.md) +##### [AppLocker](windows-defender-application-control/applocker/applocker-overview.md) #### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) -##### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) - -##### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) -##### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) -###### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) +##### [Compare with EMET](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) +##### [Evaluate](windows-defender-exploit-guard\evaluate-exploit-protection.md) +##### [Enable](windows-defender-exploit-guard\enable-exploit-protection.md) +##### [Customize](windows-defender-exploit-guard\customize-exploit-protection.md) +###### [Import, export, and deploy](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) #### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) +##### [Evaluate](windows-defender-exploit-guard\evaluate-network-protection.md) +##### [Enable](windows-defender-exploit-guard\enable-network-protection.md) +##### [Troubleshoot](windows-defender-exploit-guard\troubleshoot-np.md) -##### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) -##### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) #### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) - -##### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) -##### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) +##### [Evaluate](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) +##### [Enable](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) +##### [Customize](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) +#### [ASR controls] +##### [Evaluate](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +##### [Enable](windows-defender-exploit-guard\enable-attack-surface-reduction.md) +##### [Customize](windows-defender-exploit-guard\customize-attack-surface-reduction.md) +##### [Troubleshoot](windows-defender-exploit-guard\troubleshoot-asr.md) + +#### [Network firewall](windows-firewall\windows-firewall-with-advanced-security.md) +##### [Isolate Store Apps](windows-firewall\isolating-apps-on-your-network.md) +##### [Secure IPsec Connections](windows-firewall\securing-end-to-end-ipsec-connections-by-using-ikev2.md) +##### [PowerShell](windows-firewall\windows-firewall-with-advanced-security-administration-with-windows-powershell.md) +##### [Design](windows-firewall\windows-firewall-with-advanced-security-design-guide.md) +##### [Deploy](windows-firewall\windows-firewall-with-advanced-security-deployment-guide.md) -##### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) -##### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) -##### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) ### [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) #### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) @@ -494,7 +507,7 @@ ####### [Event 4733 S: A member was removed from a security-enabled local group.](auditing/event-4733.md) ####### [Event 4734 S: A security-enabled local group was deleted.](auditing/event-4734.md) ####### [Event 4735 S: A security-enabled local group was changed.](auditing/event-4735.md) -####### [Event 4764 S: A group’s type was changed.](auditing/event-4764.md) +####### [Event 4764 S: A group�s type was changed.](auditing/event-4764.md) ####### [Event 4799 S: A security-enabled local group membership was enumerated.](auditing/event-4799.md) ###### [Audit User Account Management](auditing/audit-user-account-management.md) ####### [Event 4720 S: A user account was created.](auditing/event-4720.md) diff --git a/windows/security/identity-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md b/windows/security/threat-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md rename to windows/security/threat-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md diff --git a/windows/security/identity-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md b/windows/security/threat-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md rename to windows/security/threat-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md diff --git a/windows/security/identity-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md b/windows/security/threat-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md rename to windows/security/threat-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md diff --git a/windows/security/identity-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md b/windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md rename to windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md diff --git a/windows/security/identity-protection/windows-firewall/basic-firewall-policy-design.md b/windows/security/threat-protection/windows-firewall/basic-firewall-policy-design.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/basic-firewall-policy-design.md rename to windows/security/threat-protection/windows-firewall/basic-firewall-policy-design.md diff --git a/windows/security/identity-protection/windows-firewall/boundary-zone-gpos.md b/windows/security/threat-protection/windows-firewall/boundary-zone-gpos.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/boundary-zone-gpos.md rename to windows/security/threat-protection/windows-firewall/boundary-zone-gpos.md diff --git a/windows/security/identity-protection/windows-firewall/boundary-zone.md b/windows/security/threat-protection/windows-firewall/boundary-zone.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/boundary-zone.md rename to windows/security/threat-protection/windows-firewall/boundary-zone.md diff --git a/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design-example.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design-example.md rename to windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design-example.md diff --git a/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design.md rename to windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md diff --git a/windows/security/identity-protection/windows-firewall/change-rules-from-request-to-require-mode.md b/windows/security/threat-protection/windows-firewall/change-rules-from-request-to-require-mode.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/change-rules-from-request-to-require-mode.md rename to windows/security/threat-protection/windows-firewall/change-rules-from-request-to-require-mode.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md rename to windows/security/threat-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md rename to windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md rename to windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md rename to windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md rename to windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md rename to windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-creating-group-policy-objects.md b/windows/security/threat-protection/windows-firewall/checklist-creating-group-policy-objects.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-creating-group-policy-objects.md rename to windows/security/threat-protection/windows-firewall/checklist-creating-group-policy-objects.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md b/windows/security/threat-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md rename to windows/security/threat-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md b/windows/security/threat-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md rename to windows/security/threat-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md b/windows/security/threat-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md rename to windows/security/threat-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md rename to windows/security/threat-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md rename to windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md rename to windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md diff --git a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md rename to windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md diff --git a/windows/security/identity-protection/windows-firewall/configure-authentication-methods.md b/windows/security/threat-protection/windows-firewall/configure-authentication-methods.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/configure-authentication-methods.md rename to windows/security/threat-protection/windows-firewall/configure-authentication-methods.md diff --git a/windows/security/identity-protection/windows-firewall/configure-data-protection-quick-mode-settings.md b/windows/security/threat-protection/windows-firewall/configure-data-protection-quick-mode-settings.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/configure-data-protection-quick-mode-settings.md rename to windows/security/threat-protection/windows-firewall/configure-data-protection-quick-mode-settings.md diff --git a/windows/security/identity-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md b/windows/security/threat-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md rename to windows/security/threat-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md diff --git a/windows/security/identity-protection/windows-firewall/configure-key-exchange-main-mode-settings.md b/windows/security/threat-protection/windows-firewall/configure-key-exchange-main-mode-settings.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/configure-key-exchange-main-mode-settings.md rename to windows/security/threat-protection/windows-firewall/configure-key-exchange-main-mode-settings.md diff --git a/windows/security/identity-protection/windows-firewall/configure-the-rules-to-require-encryption.md b/windows/security/threat-protection/windows-firewall/configure-the-rules-to-require-encryption.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/configure-the-rules-to-require-encryption.md rename to windows/security/threat-protection/windows-firewall/configure-the-rules-to-require-encryption.md diff --git a/windows/security/identity-protection/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/configure-the-windows-firewall-log.md rename to windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log.md diff --git a/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md b/windows/security/threat-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md rename to windows/security/threat-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md diff --git a/windows/security/identity-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md b/windows/security/threat-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md rename to windows/security/threat-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md diff --git a/windows/security/identity-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md b/windows/security/threat-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md rename to windows/security/threat-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md diff --git a/windows/security/identity-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md rename to windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md diff --git a/windows/security/identity-protection/windows-firewall/create-a-group-account-in-active-directory.md b/windows/security/threat-protection/windows-firewall/create-a-group-account-in-active-directory.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/create-a-group-account-in-active-directory.md rename to windows/security/threat-protection/windows-firewall/create-a-group-account-in-active-directory.md diff --git a/windows/security/identity-protection/windows-firewall/create-a-group-policy-object.md b/windows/security/threat-protection/windows-firewall/create-a-group-policy-object.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/create-a-group-policy-object.md rename to windows/security/threat-protection/windows-firewall/create-a-group-policy-object.md diff --git a/windows/security/identity-protection/windows-firewall/create-an-authentication-exemption-list-rule.md b/windows/security/threat-protection/windows-firewall/create-an-authentication-exemption-list-rule.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/create-an-authentication-exemption-list-rule.md rename to windows/security/threat-protection/windows-firewall/create-an-authentication-exemption-list-rule.md diff --git a/windows/security/identity-protection/windows-firewall/create-an-authentication-request-rule.md b/windows/security/threat-protection/windows-firewall/create-an-authentication-request-rule.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/create-an-authentication-request-rule.md rename to windows/security/threat-protection/windows-firewall/create-an-authentication-request-rule.md diff --git a/windows/security/identity-protection/windows-firewall/create-an-inbound-icmp-rule.md b/windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/create-an-inbound-icmp-rule.md rename to windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule.md diff --git a/windows/security/identity-protection/windows-firewall/create-an-inbound-port-rule.md b/windows/security/threat-protection/windows-firewall/create-an-inbound-port-rule.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/create-an-inbound-port-rule.md rename to windows/security/threat-protection/windows-firewall/create-an-inbound-port-rule.md diff --git a/windows/security/identity-protection/windows-firewall/create-an-inbound-program-or-service-rule.md b/windows/security/threat-protection/windows-firewall/create-an-inbound-program-or-service-rule.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/create-an-inbound-program-or-service-rule.md rename to windows/security/threat-protection/windows-firewall/create-an-inbound-program-or-service-rule.md diff --git a/windows/security/identity-protection/windows-firewall/create-an-outbound-port-rule.md b/windows/security/threat-protection/windows-firewall/create-an-outbound-port-rule.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/create-an-outbound-port-rule.md rename to windows/security/threat-protection/windows-firewall/create-an-outbound-port-rule.md diff --git a/windows/security/identity-protection/windows-firewall/create-an-outbound-program-or-service-rule.md b/windows/security/threat-protection/windows-firewall/create-an-outbound-program-or-service-rule.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/create-an-outbound-program-or-service-rule.md rename to windows/security/threat-protection/windows-firewall/create-an-outbound-program-or-service-rule.md diff --git a/windows/security/identity-protection/windows-firewall/create-inbound-rules-to-support-rpc.md b/windows/security/threat-protection/windows-firewall/create-inbound-rules-to-support-rpc.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/create-inbound-rules-to-support-rpc.md rename to windows/security/threat-protection/windows-firewall/create-inbound-rules-to-support-rpc.md diff --git a/windows/security/identity-protection/windows-firewall/create-wmi-filters-for-the-gpo.md b/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/create-wmi-filters-for-the-gpo.md rename to windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md diff --git a/windows/security/identity-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md b/windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md rename to windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md diff --git a/windows/security/identity-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md b/windows/security/threat-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md rename to windows/security/threat-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md diff --git a/windows/security/identity-protection/windows-firewall/documenting-the-zones.md b/windows/security/threat-protection/windows-firewall/documenting-the-zones.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/documenting-the-zones.md rename to windows/security/threat-protection/windows-firewall/documenting-the-zones.md diff --git a/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/domain-isolation-policy-design-example.md rename to windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md diff --git a/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/domain-isolation-policy-design.md rename to windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md diff --git a/windows/security/identity-protection/windows-firewall/enable-predefined-inbound-rules.md b/windows/security/threat-protection/windows-firewall/enable-predefined-inbound-rules.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/enable-predefined-inbound-rules.md rename to windows/security/threat-protection/windows-firewall/enable-predefined-inbound-rules.md diff --git a/windows/security/identity-protection/windows-firewall/enable-predefined-outbound-rules.md b/windows/security/threat-protection/windows-firewall/enable-predefined-outbound-rules.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/enable-predefined-outbound-rules.md rename to windows/security/threat-protection/windows-firewall/enable-predefined-outbound-rules.md diff --git a/windows/security/identity-protection/windows-firewall/encryption-zone-gpos.md b/windows/security/threat-protection/windows-firewall/encryption-zone-gpos.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/encryption-zone-gpos.md rename to windows/security/threat-protection/windows-firewall/encryption-zone-gpos.md diff --git a/windows/security/identity-protection/windows-firewall/encryption-zone.md b/windows/security/threat-protection/windows-firewall/encryption-zone.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/encryption-zone.md rename to windows/security/threat-protection/windows-firewall/encryption-zone.md diff --git a/windows/security/identity-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md b/windows/security/threat-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md rename to windows/security/threat-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md diff --git a/windows/security/identity-protection/windows-firewall/exempt-icmp-from-authentication.md b/windows/security/threat-protection/windows-firewall/exempt-icmp-from-authentication.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/exempt-icmp-from-authentication.md rename to windows/security/threat-protection/windows-firewall/exempt-icmp-from-authentication.md diff --git a/windows/security/identity-protection/windows-firewall/exemption-list.md b/windows/security/threat-protection/windows-firewall/exemption-list.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/exemption-list.md rename to windows/security/threat-protection/windows-firewall/exemption-list.md diff --git a/windows/security/identity-protection/windows-firewall/firewall-gpos.md b/windows/security/threat-protection/windows-firewall/firewall-gpos.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/firewall-gpos.md rename to windows/security/threat-protection/windows-firewall/firewall-gpos.md diff --git a/windows/security/identity-protection/windows-firewall/firewall-policy-design-example.md b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/firewall-policy-design-example.md rename to windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md diff --git a/windows/security/identity-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md rename to windows/security/threat-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md diff --git a/windows/security/identity-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md rename to windows/security/threat-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md diff --git a/windows/security/identity-protection/windows-firewall/gathering-information-about-your-devices.md b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-devices.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/gathering-information-about-your-devices.md rename to windows/security/threat-protection/windows-firewall/gathering-information-about-your-devices.md diff --git a/windows/security/identity-protection/windows-firewall/gathering-other-relevant-information.md b/windows/security/threat-protection/windows-firewall/gathering-other-relevant-information.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/gathering-other-relevant-information.md rename to windows/security/threat-protection/windows-firewall/gathering-other-relevant-information.md diff --git a/windows/security/identity-protection/windows-firewall/gathering-the-information-you-need.md b/windows/security/threat-protection/windows-firewall/gathering-the-information-you-need.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/gathering-the-information-you-need.md rename to windows/security/threat-protection/windows-firewall/gathering-the-information-you-need.md diff --git a/windows/security/identity-protection/windows-firewall/gpo-domiso-boundary.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-boundary.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/gpo-domiso-boundary.md rename to windows/security/threat-protection/windows-firewall/gpo-domiso-boundary.md diff --git a/windows/security/identity-protection/windows-firewall/gpo-domiso-encryption.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-encryption.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/gpo-domiso-encryption.md rename to windows/security/threat-protection/windows-firewall/gpo-domiso-encryption.md diff --git a/windows/security/identity-protection/windows-firewall/gpo-domiso-firewall.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-firewall.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/gpo-domiso-firewall.md rename to windows/security/threat-protection/windows-firewall/gpo-domiso-firewall.md diff --git a/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md rename to windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md diff --git a/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md rename to windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md diff --git a/windows/security/identity-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md b/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md rename to windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md diff --git a/windows/security/identity-protection/windows-firewall/images/corpnet.gif b/windows/security/threat-protection/windows-firewall/images/corpnet.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/corpnet.gif rename to windows/security/threat-protection/windows-firewall/images/corpnet.gif diff --git a/windows/security/identity-protection/windows-firewall/images/createipsecrule.gif b/windows/security/threat-protection/windows-firewall/images/createipsecrule.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/createipsecrule.gif rename to windows/security/threat-protection/windows-firewall/images/createipsecrule.gif diff --git a/windows/security/identity-protection/windows-firewall/images/powershelllogosmall.gif b/windows/security/threat-protection/windows-firewall/images/powershelllogosmall.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/powershelllogosmall.gif rename to windows/security/threat-protection/windows-firewall/images/powershelllogosmall.gif diff --git a/windows/security/identity-protection/windows-firewall/images/qmcryptoset.gif b/windows/security/threat-protection/windows-firewall/images/qmcryptoset.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/qmcryptoset.gif rename to windows/security/threat-protection/windows-firewall/images/qmcryptoset.gif diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-design2example1.gif b/windows/security/threat-protection/windows-firewall/images/wfas-design2example1.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/wfas-design2example1.gif rename to windows/security/threat-protection/windows-firewall/images/wfas-design2example1.gif diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-design3example1.gif b/windows/security/threat-protection/windows-firewall/images/wfas-design3example1.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/wfas-design3example1.gif rename to windows/security/threat-protection/windows-firewall/images/wfas-design3example1.gif diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-designexample1.gif b/windows/security/threat-protection/windows-firewall/images/wfas-designexample1.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/wfas-designexample1.gif rename to windows/security/threat-protection/windows-firewall/images/wfas-designexample1.gif diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-designflowchart1.gif b/windows/security/threat-protection/windows-firewall/images/wfas-designflowchart1.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/wfas-designflowchart1.gif rename to windows/security/threat-protection/windows-firewall/images/wfas-designflowchart1.gif diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-domainiso.gif b/windows/security/threat-protection/windows-firewall/images/wfas-domainiso.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/wfas-domainiso.gif rename to windows/security/threat-protection/windows-firewall/images/wfas-domainiso.gif diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-domainisoencrypt.gif b/windows/security/threat-protection/windows-firewall/images/wfas-domainisoencrypt.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/wfas-domainisoencrypt.gif rename to windows/security/threat-protection/windows-firewall/images/wfas-domainisoencrypt.gif diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-domainisohighsec.gif b/windows/security/threat-protection/windows-firewall/images/wfas-domainisohighsec.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/wfas-domainisohighsec.gif rename to windows/security/threat-protection/windows-firewall/images/wfas-domainisohighsec.gif diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-domainnag.gif b/windows/security/threat-protection/windows-firewall/images/wfas-domainnag.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/wfas-domainnag.gif rename to windows/security/threat-protection/windows-firewall/images/wfas-domainnag.gif diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-icon-checkbox.gif b/windows/security/threat-protection/windows-firewall/images/wfas-icon-checkbox.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/wfas-icon-checkbox.gif rename to windows/security/threat-protection/windows-firewall/images/wfas-icon-checkbox.gif diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-implement.gif b/windows/security/threat-protection/windows-firewall/images/wfas-implement.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/wfas-implement.gif rename to windows/security/threat-protection/windows-firewall/images/wfas-implement.gif diff --git a/windows/security/identity-protection/windows-firewall/images/wfasdomainisoboundary.gif b/windows/security/threat-protection/windows-firewall/images/wfasdomainisoboundary.gif similarity index 100% rename from windows/security/identity-protection/windows-firewall/images/wfasdomainisoboundary.gif rename to windows/security/threat-protection/windows-firewall/images/wfasdomainisoboundary.gif diff --git a/windows/security/identity-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md rename to windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md diff --git a/windows/security/identity-protection/windows-firewall/isolated-domain-gpos.md b/windows/security/threat-protection/windows-firewall/isolated-domain-gpos.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/isolated-domain-gpos.md rename to windows/security/threat-protection/windows-firewall/isolated-domain-gpos.md diff --git a/windows/security/identity-protection/windows-firewall/isolated-domain.md b/windows/security/threat-protection/windows-firewall/isolated-domain.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/isolated-domain.md rename to windows/security/threat-protection/windows-firewall/isolated-domain.md diff --git a/windows/security/identity-protection/windows-firewall/isolating-apps-on-your-network.md b/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/isolating-apps-on-your-network.md rename to windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md diff --git a/windows/security/identity-protection/windows-firewall/link-the-gpo-to-the-domain.md b/windows/security/threat-protection/windows-firewall/link-the-gpo-to-the-domain.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/link-the-gpo-to-the-domain.md rename to windows/security/threat-protection/windows-firewall/link-the-gpo-to-the-domain.md diff --git a/windows/security/identity-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md b/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md rename to windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md diff --git a/windows/security/identity-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md b/windows/security/threat-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md rename to windows/security/threat-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md diff --git a/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md rename to windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md diff --git a/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md rename to windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md diff --git a/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md rename to windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md diff --git a/windows/security/identity-protection/windows-firewall/open-windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/open-windows-firewall-with-advanced-security.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/open-windows-firewall-with-advanced-security.md rename to windows/security/threat-protection/windows-firewall/open-windows-firewall-with-advanced-security.md diff --git a/windows/security/identity-protection/windows-firewall/planning-certificate-based-authentication.md b/windows/security/threat-protection/windows-firewall/planning-certificate-based-authentication.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/planning-certificate-based-authentication.md rename to windows/security/threat-protection/windows-firewall/planning-certificate-based-authentication.md diff --git a/windows/security/identity-protection/windows-firewall/planning-domain-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/planning-domain-isolation-zones.md rename to windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md diff --git a/windows/security/identity-protection/windows-firewall/planning-gpo-deployment.md b/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/planning-gpo-deployment.md rename to windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md diff --git a/windows/security/identity-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md rename to windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md diff --git a/windows/security/identity-protection/windows-firewall/planning-isolation-groups-for-the-zones.md b/windows/security/threat-protection/windows-firewall/planning-isolation-groups-for-the-zones.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/planning-isolation-groups-for-the-zones.md rename to windows/security/threat-protection/windows-firewall/planning-isolation-groups-for-the-zones.md diff --git a/windows/security/identity-protection/windows-firewall/planning-network-access-groups.md b/windows/security/threat-protection/windows-firewall/planning-network-access-groups.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/planning-network-access-groups.md rename to windows/security/threat-protection/windows-firewall/planning-network-access-groups.md diff --git a/windows/security/identity-protection/windows-firewall/planning-server-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/planning-server-isolation-zones.md rename to windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md diff --git a/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md b/windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md rename to windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md diff --git a/windows/security/identity-protection/windows-firewall/planning-the-gpos.md b/windows/security/threat-protection/windows-firewall/planning-the-gpos.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/planning-the-gpos.md rename to windows/security/threat-protection/windows-firewall/planning-the-gpos.md diff --git a/windows/security/identity-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md rename to windows/security/threat-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md diff --git a/windows/security/identity-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md b/windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md rename to windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md diff --git a/windows/security/identity-protection/windows-firewall/procedures-used-in-this-guide.md b/windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/procedures-used-in-this-guide.md rename to windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md diff --git a/windows/security/identity-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md b/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md rename to windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md diff --git a/windows/security/identity-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md rename to windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md diff --git a/windows/security/identity-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md rename to windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md diff --git a/windows/security/identity-protection/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/restrict-access-to-only-trusted-devices.md rename to windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md diff --git a/windows/security/identity-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md b/windows/security/threat-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md rename to windows/security/threat-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md diff --git a/windows/security/identity-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md rename to windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md diff --git a/windows/security/identity-protection/windows-firewall/server-isolation-gpos.md b/windows/security/threat-protection/windows-firewall/server-isolation-gpos.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/server-isolation-gpos.md rename to windows/security/threat-protection/windows-firewall/server-isolation-gpos.md diff --git a/windows/security/identity-protection/windows-firewall/server-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/server-isolation-policy-design-example.md rename to windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md diff --git a/windows/security/identity-protection/windows-firewall/server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/server-isolation-policy-design.md rename to windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md diff --git a/windows/security/identity-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md b/windows/security/threat-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md rename to windows/security/threat-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md diff --git a/windows/security/identity-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md b/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md rename to windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md diff --git a/windows/security/identity-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md b/windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md rename to windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md diff --git a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md rename to windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md diff --git a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md rename to windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md diff --git a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md rename to windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md diff --git a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md similarity index 100% rename from windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security.md rename to windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md From 3148ab6ec838c1a7ca8a55f40607a7838efbdbf5 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 3 Aug 2018 12:20:15 -0700 Subject: [PATCH 033/286] fixed toc issues --- windows/security/threat-protection/TOC.md | 24 +++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index d20ee0b3ef..41c6cb89c5 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -15,14 +15,14 @@ #### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) ####Evaluate Windows Defender ATP -##### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) -##### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) -##### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) -##### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) -##### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) -##### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) -##### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) -##### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) +##### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) +##### [ASR](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) +###### [Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) +###### [Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) +###### [Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) +###### [ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +###### [Auditing mode](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) +##### [Next gen protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) @@ -148,11 +148,11 @@ -### [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) -#### [Hardware-based isolation](windows-defender-application-guard/wd-app-guard-overview.md) +### [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\windows-defender-exploit-guard.md) +#### [Hardware-based isolation](windows-defender-application-guard\wd-app-guard-overview.md) ##### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) -#### [Application Control](windows-defender-application-control/windows-defender-application-control.md) +#### [Application control](windows-defender-application-control/windows-defender-application-control.md) ##### [Design](windows-defender-application-control/windows-defender-application-control-design-guide.md) ##### [Deploy](windows-defender-application-control/windows-defender-application-control-deployment-guide.md) ##### [AppLocker](windows-defender-application-control/applocker/applocker-overview.md) @@ -175,7 +175,7 @@ ##### [Customize](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) -#### [ASR controls] +#### [ASR controls](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) ##### [Evaluate](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) ##### [Enable](windows-defender-exploit-guard\enable-attack-surface-reduction.md) ##### [Customize](windows-defender-exploit-guard\customize-attack-surface-reduction.md) From 3c504612adb5c19f54c3c4dbf47c09d858da952c Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 3 Aug 2018 13:01:43 -0700 Subject: [PATCH 034/286] fixed toc --- windows/security/threat-protection/TOC.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 41c6cb89c5..1fcc1f70de 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -15,13 +15,15 @@ #### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) ####Evaluate Windows Defender ATP -##### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) ##### [ASR](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) +###### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) +###### [Application control](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) ###### [Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) ###### [Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) ###### [Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) ###### [ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) ###### [Auditing mode](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) +###### [Network firewall](windows-firewall\evaluating-windows-firewall-with-advanced-security-design-examples.md) ##### [Next gen protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) @@ -149,6 +151,7 @@ ### [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\windows-defender-exploit-guard.md) + #### [Hardware-based isolation](windows-defender-application-guard\wd-app-guard-overview.md) ##### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) @@ -407,7 +410,8 @@ -## Other security features +## More Windows 10 security + ### [The Windows Security app](windows-defender-security-center/windows-defender-security-center.md) #### [Customize the Windows Security app for your organization](windows-defender-security-center/wdsc-customize-contact-information.md) #### [Hide Windows Security app notifications](windows-defender-security-center/wdsc-hide-notifications.md) @@ -978,8 +982,8 @@ ### [Windows security baselines](windows-security-baselines.md) -### [Security Compliance Toolkit](security-compliance-toolkit-10.md) -### [Get support](get-support-for-security-baselines.md) +#### [Security Compliance Toolkit](security-compliance-toolkit-10.md) +#### [Get support](get-support-for-security-baselines.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) From d4e2f17bb51f2320be3653a1a9af12c129e2d69c Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 3 Aug 2018 14:21:22 -0700 Subject: [PATCH 035/286] fixed toc --- windows/security/threat-protection/TOC.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 1fcc1f70de..4d62b4212f 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -49,9 +49,17 @@ ####[Configure ASR](configure1.md) -##### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) -##### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -##### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) +##### [Hardware-based isolation](windows-defender-application-guard/configure-wd-app-guard.md) +##### [Application control](windows-defender-application-control/windows-defender-application-control-deployment-guide.md) +##### [Exploit protection](windows-defender-exploit-guard\enable-exploit-protection.md) +##### [Network Protection](windows-defender-exploit-guard\enable-network-protection.md) +##### [Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) +##### [ASR controls](windows-defender-exploit-guard\enable-attack-surface-reduction.md) +##### [Network firewall](windows-firewall\windows-firewall-with-advanced-security-deployment-guide.md) + + + + @@ -147,9 +155,6 @@ - - - ### [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\windows-defender-exploit-guard.md) #### [Hardware-based isolation](windows-defender-application-guard\wd-app-guard-overview.md) From 1fab95bf75c064b6e3c2b3b7838acab7a7d42bba Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 3 Aug 2018 16:34:47 -0700 Subject: [PATCH 036/286] fixed identity links --- windows/security/identity-protection/TOC.md | 110 ------------------ windows/security/identity-protection/index.md | 1 - 2 files changed, 111 deletions(-) diff --git a/windows/security/identity-protection/TOC.md b/windows/security/identity-protection/TOC.md index 91f27e52b9..23991e4fc0 100644 --- a/windows/security/identity-protection/TOC.md +++ b/windows/security/identity-protection/TOC.md @@ -70,115 +70,5 @@ ### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](vpn\how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md) ### [Windows 10 credential theft mitigation guide abstract](windows-credential-theft-mitigation-guide-abstract.md) -## [Windows Firewall with Advanced Security](windows-firewall/windows-firewall-with-advanced-security.md) -### [Isolating Microsoft Store Apps on Your Network](windows-firewall/isolating-apps-on-your-network.md) -### [Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012](windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md) -### [Windows Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md) -### [Windows Firewall with Advanced Security Design Guide](windows-firewall/windows-firewall-with-advanced-security-design-guide.md) -#### [Understanding the Windows Firewall with Advanced Security Design Process](windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md) -#### [Identifying Your Windows Firewall with Advanced Security Deployment Goals](windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) -##### [Protect Devices from Unwanted Network Traffic](windows-firewall/protect-devices-from-unwanted-network-traffic.md) -##### [Restrict Access to Only Trusted Devices](windows-firewall/restrict-access-to-only-trusted-devices.md) -##### [Require Encryption When Accessing Sensitive Network Resources](windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md) -##### [Restrict Access to Only Specified Users or Computers](windows-firewall/restrict-access-to-only-specified-users-or-devices.md) -#### [Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design](windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) -##### [Basic Firewall Policy Design](windows-firewall/basic-firewall-policy-design.md) -##### [Domain Isolation Policy Design](windows-firewall/domain-isolation-policy-design.md) -##### [Server Isolation Policy Design](windows-firewall/server-isolation-policy-design.md) -##### [Certificate-based Isolation Policy Design](windows-firewall/certificate-based-isolation-policy-design.md) -#### [Evaluating Windows Firewall with Advanced Security Design Examples](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) -##### [Firewall Policy Design Example](windows-firewall/firewall-policy-design-example.md) -##### [Domain Isolation Policy Design Example](windows-firewall/domain-isolation-policy-design-example.md) -##### [Server Isolation Policy Design Example](windows-firewall/server-isolation-policy-design-example.md) -##### [Certificate-based Isolation Policy Design Example](windows-firewall/certificate-based-isolation-policy-design-example.md) -#### [Designing a Windows Firewall with Advanced Security Strategy](windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md) -##### [Gathering the Information You Need](windows-firewall/gathering-the-information-you-need.md) -###### [Gathering Information about Your Current Network Infrastructure](windows-firewall/gathering-information-about-your-current-network-infrastructure.md) -###### [Gathering Information about Your Active Directory Deployment](windows-firewall/gathering-information-about-your-active-directory-deployment.md) -###### [Gathering Information about Your Computers](windows-firewall/gathering-information-about-your-devices.md) -###### [Gathering Other Relevant Information](windows-firewall/gathering-other-relevant-information.md) -##### [Determining the Trusted State of Your Computers](windows-firewall/determining-the-trusted-state-of-your-devices.md) -#### [Planning Your Windows Firewall with Advanced Security Design](windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md) -##### [Planning Settings for a Basic Firewall Policy](windows-firewall/planning-settings-for-a-basic-firewall-policy.md) -##### [Planning Domain Isolation Zones](windows-firewall/planning-domain-isolation-zones.md) -###### [Exemption List](windows-firewall/exemption-list.md) -###### [Isolated Domain](windows-firewall/isolated-domain.md) -###### [Boundary Zone](windows-firewall/boundary-zone.md) -###### [Encryption Zone](windows-firewall/encryption-zone.md) -##### [Planning Server Isolation Zones](windows-firewall/planning-server-isolation-zones.md) -##### [Planning Certificate-based Authentication](windows-firewall/planning-certificate-based-authentication.md) -###### [Documenting the Zones](windows-firewall/documenting-the-zones.md) -###### [Planning Group Policy Deployment for Your Isolation Zones](windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md) -####### [Planning Isolation Groups for the Zones](windows-firewall/planning-isolation-groups-for-the-zones.md) -####### [Planning Network Access Groups](windows-firewall/planning-network-access-groups.md) -####### [Planning the GPOs](windows-firewall/planning-the-gpos.md) -######## [Firewall GPOs](windows-firewall/firewall-gpos.md) -######### [GPO_DOMISO_Firewall](windows-firewall/gpo-domiso-firewall.md) -######## [Isolated Domain GPOs](windows-firewall/isolated-domain-gpos.md) -######### [GPO_DOMISO_IsolatedDomain_Clients](windows-firewall/gpo-domiso-isolateddomain-clients.md) -######### [GPO_DOMISO_IsolatedDomain_Servers](windows-firewall/gpo-domiso-isolateddomain-servers.md) -######## [Boundary Zone GPOs](windows-firewall/boundary-zone-gpos.md) -######### [GPO_DOMISO_Boundary](windows-firewall/gpo-domiso-boundary.md) -######## [Encryption Zone GPOs](windows-firewall/encryption-zone-gpos.md) -######### [GPO_DOMISO_Encryption](windows-firewall/gpo-domiso-encryption.md) -######## [Server Isolation GPOs](windows-firewall/server-isolation-gpos.md) -####### [Planning GPO Deployment](windows-firewall/planning-gpo-deployment.md) -#### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) -### [Windows Firewall with Advanced Security Deployment Guide](windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md) -#### [Planning to Deploy Windows Firewall with Advanced Security](windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md) -#### [Implementing Your Windows Firewall with Advanced Security Design Plan](windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md) -#### [Checklist: Creating Group Policy Objects](windows-firewall/checklist-creating-group-policy-objects.md) -#### [Checklist: Implementing a Basic Firewall Policy Design](windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md) -#### [Checklist: Configuring Basic Firewall Settings](windows-firewall/checklist-configuring-basic-firewall-settings.md) -#### [Checklist: Creating Inbound Firewall Rules](windows-firewall/checklist-creating-inbound-firewall-rules.md) -#### [Checklist: Creating Outbound Firewall Rules](windows-firewall/checklist-creating-outbound-firewall-rules.md) -#### [Checklist: Implementing a Domain Isolation Policy Design](windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md) -##### [Checklist: Configuring Rules for the Isolated Domain](windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md) -##### [Checklist: Configuring Rules for the Boundary Zone](windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md) -##### [Checklist: Configuring Rules for the Encryption Zone](windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md) -##### [Checklist: Configuring Rules for an Isolated Server Zone](windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md) -#### [Checklist: Implementing a Standalone Server Isolation Policy Design](windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md) -##### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) -##### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) -#### [Checklist: Implementing a Certificate-based Isolation Policy Design](windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md) -#### [Procedures Used in This Guide](windows-firewall/procedures-used-in-this-guide.md) -##### [Add Production Devices to the Membership Group for a Zone](windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md) -##### [Add Test Devices to the Membership Group for a Zone](windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md) -##### [Assign Security Group Filters to the GPO](windows-firewall/assign-security-group-filters-to-the-gpo.md) -##### [Change Rules from Request to Require Mode](windows-firewall/change-rules-from-request-to-require-mode.md) -##### [Configure Authentication Methods](windows-firewall/configure-authentication-methods.md) -##### [Configure Data Protection (Quick Mode) Settings](windows-firewall/configure-data-protection-quick-mode-settings.md) -##### [Configure Group Policy to Autoenroll and Deploy Certificates](windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md) -##### [Configure Key Exchange (Main Mode) Settings](windows-firewall/configure-key-exchange-main-mode-settings.md) -##### [Configure the Rules to Require Encryption](windows-firewall/configure-the-rules-to-require-encryption.md) -##### [Configure the Windows Firewall Log](windows-firewall/configure-the-windows-firewall-log.md) -##### [Configure the Workstation Authentication Certificate Template](windows-firewall/configure-the-workstation-authentication-certificate-template.md) -##### [Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) -##### [Confirm That Certificates Are Deployed Correctly](windows-firewall/confirm-that-certificates-are-deployed-correctly.md) -##### [Copy a GPO to Create a New GPO](windows-firewall/copy-a-gpo-to-create-a-new-gpo.md) -##### [Create a Group Account in Active Directory](windows-firewall/create-a-group-account-in-active-directory.md) -##### [Create a Group Policy Object](windows-firewall/create-a-group-policy-object.md) -##### [Create an Authentication Exemption List Rule](windows-firewall/create-an-authentication-exemption-list-rule.md) -##### [Create an Authentication Request Rule](windows-firewall/create-an-authentication-request-rule.md) -##### [Create an Inbound ICMP Rule](windows-firewall/create-an-inbound-icmp-rule.md) -##### [Create an Inbound Port Rule](windows-firewall/create-an-inbound-port-rule.md) -##### [Create an Inbound Program or Service Rule](windows-firewall/create-an-inbound-program-or-service-rule.md) -##### [Create an Outbound Port Rule](windows-firewall/create-an-outbound-port-rule.md) -##### [Create an Outbound Program or Service Rule](windows-firewall/create-an-outbound-program-or-service-rule.md) -##### [Create Inbound Rules to Support RPC](windows-firewall/create-inbound-rules-to-support-rpc.md) -##### [Create WMI Filters for the GPO](windows-firewall/create-wmi-filters-for-the-gpo.md) -##### [Enable Predefined Inbound Rules](windows-firewall/enable-predefined-inbound-rules.md) -##### [Enable Predefined Outbound Rules](windows-firewall/enable-predefined-outbound-rules.md) -##### [Exempt ICMP from Authentication](windows-firewall/exempt-icmp-from-authentication.md) -##### [Link the GPO to the Domain](windows-firewall/link-the-gpo-to-the-domain.md) -##### [Modify GPO Filters to Apply to a Different Zone or Version of Windows](windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) -##### [Open the Group Policy Management Console to IP Security Policies](windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md) -##### [Open the Group Policy Management Console to Windows Firewall](windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md) -##### [Open the Group Policy Management Console to Windows Firewall with Advanced Security](windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) -##### [Open Windows Firewall with Advanced Security](windows-firewall/open-windows-firewall-with-advanced-security.md) -##### [Restrict Server Access to Members of a Group Only](windows-firewall/restrict-server-access-to-members-of-a-group-only.md) -##### [Turn on Windows Firewall and Configure Default Behavior](windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md) -##### [Verify That Network Traffic Is Authenticated](windows-firewall/verify-that-network-traffic-is-authenticated.md) - ## [Windows Hello for Business](hello-for-business/hello-identity-verification.md) diff --git a/windows/security/identity-protection/index.md b/windows/security/identity-protection/index.md index 7208a54485..1e0b600031 100644 --- a/windows/security/identity-protection/index.md +++ b/windows/security/identity-protection/index.md @@ -25,5 +25,4 @@ Learn more about identity annd access management technologies in Windows 10 and | [VPN technical guide](vpn/vpn-guide.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. | | [Smart Cards](smart-cards/smart-card-windows-smart-card-technical-reference.md) | Provides a collection of references topics about smart cards, which are tamper-resistant portable storage devices that can enhance the security of tasks such as authenticating clients, signing code, securing e-mail, and signing in with a Windows domain account. | | [Windows Hello for Business](hello-for-business/hello-identity-verification.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. | -| [Windows Firewall with Advanced Security](windows-firewall/windows-firewall-with-advanced-security.md) | Provides information about Windows Firewall with Advanced Security, which is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Firewall with Advanced Security blocks unauthorized network traffic flowing into or out of the local device. | | [Windows 10 Credential Theft Mitigation Guide Abstract](windows-credential-theft-mitigation-guide-abstract.md) | Learn more about credential theft mitigation in Windows 10. | From 09d0eae1968c6f0e5a0ae5fda05a65c96c1843bf Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 7 Aug 2018 06:58:23 -0700 Subject: [PATCH 037/286] update toc, update wdatp landing page --- windows/security/threat-protection/TOC.md | 6 ++--- .../{faketopic.md => edr.md} | 0 .../threat-protection/securityposture.md | 23 ++++++++++++++++++ ...ows-defender-advanced-threat-protection.md | 24 +++++++++---------- 4 files changed, 37 insertions(+), 16 deletions(-) rename windows/security/threat-protection/{faketopic.md => edr.md} (100%) create mode 100644 windows/security/threat-protection/securityposture.md diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 320952520f..39f870db9e 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -189,7 +189,7 @@ -### [Endpoint detection and response - Tomer B.](faketopic.md) +### [Endpoint detection and response - Tomer B.](edr.md) ####Alerts queue ##### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) ##### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md) @@ -243,8 +243,8 @@ ###Security posture -#### [Secure posture - Evald](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) -#### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) +#### [Secure posture - Evald](windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md) +#### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/faketopic.md b/windows/security/threat-protection/edr.md similarity index 100% rename from windows/security/threat-protection/faketopic.md rename to windows/security/threat-protection/edr.md diff --git a/windows/security/threat-protection/securityposture.md b/windows/security/threat-protection/securityposture.md new file mode 100644 index 0000000000..b9b4cdf197 --- /dev/null +++ b/windows/security/threat-protection/securityposture.md @@ -0,0 +1,23 @@ +--- +title: Security posture +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 09/12/2018 +--- + +## Security posture +This capability provides tailored insight on the current security state of your organization. Leverage the various insights within this capability to assess the security posture of your organization, see where attention is required, and apply the recommended action to contain attacks, increase your organizational resilience, and prevent specific threats. + + +## In this section + +[Secure score](windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md)| Expand your visibility into the overall security posture of your organization. +[Threat analytics](windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) | Assess the organizational impact of emerging threats and take the recommended actions to contain attacks, increase your organizational resilience, and prevent specific threats. diff --git a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md index 07eee21200..3d2c0bcddb 100644 --- a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md @@ -10,16 +10,11 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 07/12/2018 +ms.date: 09/12/2018 --- # Windows Defender Advanced Threat Protection -**Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - - - >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-main-abovefoldlink) > >For more info about Windows 10 Enterprise Edition features and functionality, see [Windows 10 Enterprise edition](https://www.microsoft.com/WindowsForBusiness/buy). @@ -34,13 +29,16 @@ The Windows Defender ATP platform is where all the capabilities that are availab Topic | Description :---|:--- -[Windows Defender Security Center](windows-defender-security-center-atp.md) | Windows Defender Security Center is the portal where you can access Windows Defender Advanced Threat Protection capabilities. It gives enterprise security operations teams a single pane of glass experience to help secure networks. -[Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) | Windows Defender Antivirus is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers. -[Windows Defender Exploit Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard) | Windows Defender Exploit Guard (Windows Defender EG) is a new set of host intrusion prevention capabilities for Windows 10, allowing you to manage and reduce the attack surface of apps used by your employees. -[Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) | Windows Defender Application Control (WDAC) can help mitigate security threats by restricting the applications that users are allowed to run and the code that runs in the System Core (kernel). -[Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) | Windows Defender Application Guard helps to isolate enterprise-defined untrusted sites, protecting your company while your employees browse the Internet. - - +Get started | Learn about the requirements of the platform and the intial steps you need to take to get started with Windows Defender ATP. +[Onboard and configure machines to Windows Defender ATP](../onboard.md)| Onboard to the sensor, configure the indivual capabilities in Windows Defender ATP. +[Windows Defender Security Center](use-windows-defender-advanced-threat-protection.md)| Understand how to use the Windows Defender Security Center portal and the capabilities you can leverage to better protect your organization. +[Attack surface reduction](../windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) | Leverage the intrusion prevention capabilities such as application control, exploit protection, and others to manage and reduce the attack surface of your organization. +[Next generation protection](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) | Learn about the antivirus, machine learning, and other capabilities to further reinforce the security perimeter of your organization. +[Endpoint detection and response](../edr.md)| Detect, investigate, and respond to advanced threats that may have made it past the first two security pillars using the endpoint detection and response capabilities. +[Auto investigation](automated-investigations-windows-defender-advanced-threat-protection.md)| Reduce the volume of alerts that need to be investigated individually by leveraging the auto investigation capability. +[Security posture](../securityposture.md)| Assess the security posture of your organization, see where attention is required, and apply the recommended action to contain attacks, increase your organizational resilience, and prevent specific threats. +[Management and APIs]() | Learn about the tools you can use to manage, integrate with, such as APIs, SIEM connectors, reporting, and others. +[Microsoft threat protection](../integration.md)| The platform is designed to integrate well with other Microsoft products. Learn about how you can maximize other Microsoft security offerings to further expand your security coverage. ## Related topic [Windows Defender ATP helps detect sophisticated threats](https://www.microsoft.com/itshowcase/Article/Content/854/Windows-Defender-ATP-helps-detect-sophisticated-threats) From bf7c5ea3198de3a1ff27c20a7b7e83a126025ab4 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 7 Aug 2018 07:30:18 -0700 Subject: [PATCH 038/286] add get started content --- windows/security/threat-protection/TOC.md | 4 +-- .../security/threat-protection/get-started.md | 31 +++++++++++++++++++ .../windows-defender-atp/TOC.md | 2 +- ...ows-defender-advanced-threat-protection.md | 2 +- 4 files changed, 35 insertions(+), 4 deletions(-) create mode 100644 windows/security/threat-protection/get-started.md diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 4e6226b6ac..147feb3187 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -6,8 +6,8 @@ ## [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) -###Get started -#### [Minimum requirements](windows-defender-atp\minimum-requirements-windows-defender-advanced-threat-protection.md) +### [Get started](get-started.md) | +#### [Minimum requirements](windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md) #### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md) #### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) #### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/get-started.md b/windows/security/threat-protection/get-started.md new file mode 100644 index 0000000000..d2472b2ce0 --- /dev/null +++ b/windows/security/threat-protection/get-started.md @@ -0,0 +1,31 @@ +--- +title: Get started with Windows Defender Advanced Threat Protection +description: Learn about the minimum requirements and initial steps you need to take to get started with Windows Defender ATP. +keywords: get started, minimum requirements, setup, subscription, features, data storage, privacy, user access +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 09/12/2018 +--- + +## Get started with Windows Defender Advanced Threat Protection +Learn about the minimum requirements and initial steps you need to take to get started with Windows Defender ATP. + + +## In this section + + +Topic | Description +:---|:--- +[Minimum requirements](windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md) | Learn about the requirements for onboarding machines to the platform. +[Validate licensing and complete setup](windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md) | Get guidance on how to check that licenses have been provisioned to your organization and how to access the portal for the first time. +[Troubleshoot subscription and portal access issues](windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) | Address issues that might surface when setting up the Windows Defender ATP service and capabilities. +[Preview features](windows-defender-atp/preview-windows-defender-advanced-threat-protection.md) | Learn about new features in the Windows Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience. +[Data storage and privacy](windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md) | Explains the data storage and privacy details related to Windows Defender ATP. +[Assign user access to the portal](windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md) | Set permissions to manage who can access the portal. You can set basic permissions or set granular permissions using role-based access control (RBAC). +[Evaluate Windows Defender ATP](evaluate.md) | Evaluate the various capabilities in Windows Defender ATP and test features out. \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 7ad06daaa2..9801ca762b 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -161,7 +161,7 @@ #### [Enable and configure always-on protection and monitoring](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) -## [Endpoint detection and response - Tomer B.](../faketopic.md) +## [Endpoint detection and response - Tomer B.](../edr.md) ###Alerts queue #### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) #### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md index 3d2c0bcddb..812fc443b3 100644 --- a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md @@ -29,7 +29,7 @@ The Windows Defender ATP platform is where all the capabilities that are availab Topic | Description :---|:--- -Get started | Learn about the requirements of the platform and the intial steps you need to take to get started with Windows Defender ATP. +[Get started](../get-started.md) | Learn about the requirements of the platform and the intial steps you need to take to get started with Windows Defender ATP. [Onboard and configure machines to Windows Defender ATP](../onboard.md)| Onboard to the sensor, configure the indivual capabilities in Windows Defender ATP. [Windows Defender Security Center](use-windows-defender-advanced-threat-protection.md)| Understand how to use the Windows Defender Security Center portal and the capabilities you can leverage to better protect your organization. [Attack surface reduction](../windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) | Leverage the intrusion prevention capabilities such as application control, exploit protection, and others to manage and reduce the attack surface of your organization. From 3fbb9c14bbb6b69f6eff226230fcd8ef0183a13d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 7 Aug 2018 07:33:04 -0700 Subject: [PATCH 039/286] add troubleshoot in landing page --- .../windows-defender-advanced-threat-protection.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md index 812fc443b3..7342a6a760 100644 --- a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md @@ -39,6 +39,7 @@ Topic | Description [Security posture](../securityposture.md)| Assess the security posture of your organization, see where attention is required, and apply the recommended action to contain attacks, increase your organizational resilience, and prevent specific threats. [Management and APIs]() | Learn about the tools you can use to manage, integrate with, such as APIs, SIEM connectors, reporting, and others. [Microsoft threat protection](../integration.md)| The platform is designed to integrate well with other Microsoft products. Learn about how you can maximize other Microsoft security offerings to further expand your security coverage. +Troubleshoot Windows Defender ATP | Learn how to address issues that you might encounter while using the platform. ## Related topic [Windows Defender ATP helps detect sophisticated threats](https://www.microsoft.com/itshowcase/Article/Content/854/Windows-Defender-ATP-helps-detect-sophisticated-threats) From 680088204478352f5d99a992f5fb005d8c6d6577 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 7 Aug 2018 09:52:09 -0700 Subject: [PATCH 040/286] update get started topic in toc link --- windows/security/threat-protection/windows-defender-atp/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 9801ca762b..272883b96d 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -1,7 +1,7 @@ # [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) -## [Get started](../fake2.md) +## [Get started](../get-started.md) ### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) ### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) ### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) From 6f35190dc41bcd187dccdc414c49e9268fbc38f1 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 7 Aug 2018 10:23:17 -0700 Subject: [PATCH 041/286] removed applies to content --- ...d-features-windows-defender-advanced-threat-protection.md | 5 +---- ...-practices-windows-defender-advanced-threat-protection.md | 5 +---- ...-reference-windows-defender-advanced-threat-protection.md | 5 +---- ...ed-hunting-windows-defender-advanced-threat-protection.md | 5 +---- ...erts-queue-windows-defender-advanced-threat-protection.md | 5 +---- ...al-mapping-windows-defender-advanced-threat-protection.md | 5 +---- ...tal-access-windows-defender-advanced-threat-protection.md | 5 +---- ...imulations-windows-defender-advanced-threat-protection.md | 5 +---- ...stigations-windows-defender-advanced-threat-protection.md | 5 +---- ...sor-status-windows-defender-advanced-threat-protection.md | 5 +---- ...nal-access-windows-defender-advanced-threat-protection.md | 5 +---- ...e-arcsight-windows-defender-advanced-threat-protection.md | 5 +---- ...ifications-windows-defender-advanced-threat-protection.md | 5 +---- ...dpoints-gp-windows-defender-advanced-threat-protection.md | 5 +---- ...points-mdm-windows-defender-advanced-threat-protection.md | 5 +---- ...oints-sccm-windows-defender-advanced-threat-protection.md | 5 +---- ...nts-script-windows-defender-advanced-threat-protection.md | 5 +---- ...-endpoints-windows-defender-advanced-threat-protection.md | 5 +---- ...y-internet-windows-defender-advanced-threat-protection.md | 5 +---- ...igure-siem-windows-defender-advanced-threat-protection.md | 5 +---- ...ure-splunk-windows-defender-advanced-threat-protection.md | 5 +---- ...tom-ti-api-windows-defender-advanced-threat-protection.md | 5 +---- ...n-settings-windows-defender-advanced-threat-protection.md | 5 +---- ...patibility-windows-defender-advanced-threat-protection.md | 5 +---- ...-custom-ti-windows-defender-advanced-threat-protection.md | 5 +---- ...cure-score-windows-defender-advanced-threat-protection.md | 5 +---- ...ntegration-windows-defender-advanced-threat-protection.md | 5 +---- ...rror-codes-windows-defender-advanced-threat-protection.md | 5 +---- ...-custom-ti-windows-defender-advanced-threat-protection.md | 5 +---- ...posed-apis-windows-defender-advanced-threat-protection.md | 5 +---- ...ty-sensors-windows-defender-advanced-threat-protection.md | 5 +---- ...ate-domain-windows-defender-advanced-threat-protection.md | 5 +---- ...gate-files-windows-defender-advanced-threat-protection.md | 5 +---- ...stigate-ip-windows-defender-advanced-threat-protection.md | 5 +---- .../licensing-windows-defender-advanced-threat-protection.md | 5 +---- ...ine-groups-windows-defender-advanced-threat-protection.md | 5 +---- ...w-overview-windows-defender-advanced-threat-protection.md | 5 +---- ...age-alerts-windows-defender-advanced-threat-protection.md | 5 +---- ...ocked-list-windows-defender-advanced-threat-protection.md | 5 +---- ...le-uploads-windows-defender-advanced-threat-protection.md | 5 +---- ...exclusions-windows-defender-advanced-threat-protection.md | 5 +---- ...sion-rules-windows-defender-advanced-threat-protection.md | 5 +---- ...quirements-windows-defender-advanced-threat-protection.md | 5 ----- ...d-machines-windows-defender-advanced-threat-protection.md | 5 +---- ...l-overview-windows-defender-advanced-threat-protection.md | 5 +---- ...bi-reports-windows-defender-advanced-threat-protection.md | 5 +---- ...ample-code-windows-defender-advanced-threat-protection.md | 5 +---- ...nces-setup-windows-defender-advanced-threat-protection.md | 5 +---- ...w-settings-windows-defender-advanced-threat-protection.md | 5 +---- .../preview-windows-defender-advanced-threat-protection.md | 5 +---- ...g-rest-api-windows-defender-advanced-threat-protection.md | 5 +---- ...ample-code-windows-defender-advanced-threat-protection.md | 5 +---- .../rbac-windows-defender-advanced-threat-protection.md | 5 +---- ...ile-alerts-windows-defender-advanced-threat-protection.md | 5 +---- ...ine-alerts-windows-defender-advanced-threat-protection.md | 5 +---- ...se-actions-windows-defender-advanced-threat-protection.md | 5 +---- ...ction-test-windows-defender-advanced-threat-protection.md | 5 +---- ...-dashboard-windows-defender-advanced-threat-protection.md | 5 +---- ...-dashboard-windows-defender-advanced-threat-protection.md | 5 +---- ...ice-status-windows-defender-advanced-threat-protection.md | 5 +---- ...orted-apis-windows-defender-advanced-threat-protection.md | 5 +---- ...-dashboard-windows-defender-advanced-threat-protection.md | 5 +---- ...r-concepts-windows-defender-advanced-threat-protection.md | 5 +---- ...e-settings-windows-defender-advanced-threat-protection.md | 5 +---- ...-custom-ti-windows-defender-advanced-threat-protection.md | 5 +---- ...r-messages-windows-defender-advanced-threat-protection.md | 5 +---- ...onboarding-windows-defender-advanced-threat-protection.md | 5 +---- ...shoot-siem-windows-defender-advanced-threat-protection.md | 5 +---- ...-custom-ti-windows-defender-advanced-threat-protection.md | 5 ----- .../use-windows-defender-advanced-threat-protection.md | 5 +---- 70 files changed, 68 insertions(+), 282 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md index b414111b05..807ab2aaa9 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 05/08/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md index 216c76d3bb..fd419d2f79 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md index 2ebe1dceb6..b594ad69f0 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 06/01/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md index 538e981c02..498e761b20 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 06/13/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md index 5d5708572e..bebf68a14f 100644 --- a/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md index 677b25564f..ee57104d76 100644 --- a/windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 10/16/2017 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md index e948d94905..f4e927fc70 100644 --- a/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md @@ -16,10 +16,7 @@ ms.date: 04/24/2018 # Assign user access to Windows Defender Security Center **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Azure Active Directory - Office 365 - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md index 37b9d32417..2dc0691f2a 100644 --- a/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 28/02/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md index 3d8ae4ab64..fcb993cfa0 100644 --- a/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 05/21/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) BENNY: look at this page and see if there are "settings/ configurations" if yes, point them to the settings page and remove it from here. diff --git a/windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md index 428fb853da..791e3e8c64 100644 --- a/windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md index 432cfcfa13..9213bcf069 100644 --- a/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md index c4633c09c3..922143b7f4 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 10/16/2017 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md index 24160d9cd2..1d3703c9be 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 07/16/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md index 980252189b..ba9cdde442 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md @@ -18,10 +18,7 @@ ms.date: 04/24/2018 **Applies to:** - Group Policy -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index 83f63e9c62..4d35506749 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index cbc1b85dda..d0bf0a6cbd 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) - System Center 2012 Configuration Manager or later versions diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md index 8236a40cf4..ea54c42092 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md index c0ae298a7a..8b93f17477 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 07/12/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 23f06ea316..d9a8498c73 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -18,10 +18,7 @@ ms.date: 05/29/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md index f499b17917..5c36c805e4 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 10/16/2017 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md index ed37cdaedb..03f3013863 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 10/16/2017 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md index 43933756ec..229300b01e 100644 --- a/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md index 2e13780e25..b98dc92230 100644 --- a/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md @@ -16,10 +16,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md index 26e859fb08..80d84f08c0 100644 --- a/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md index 1d1154af3b..4896e983e7 100644 --- a/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md index bddab1a14d..be83cc848f 100644 --- a/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md index 44e55b2b9b..123c537dc8 100644 --- a/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md index 9fe88c8887..03354b9f6a 100644 --- a/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md @@ -19,10 +19,7 @@ ms.date: 05/21/2018 **Applies to:** - Event Viewer -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md index 137a1b8070..68a5bbfdf5 100644 --- a/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 11/09/2017 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md index 8864102a57..860ff1eee2 100644 --- a/windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 10/23/2017 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md index 8d04e19940..a8224e7a00 100644 --- a/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 10/23/2017 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md index 5f1f375b3f..6e47b6ddea 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md @@ -16,10 +16,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md index f57e046676..6640bb6e9f 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md @@ -16,10 +16,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md index 8a0c91b597..29592bd0f8 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md @@ -16,10 +16,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md index 778f8d48b4..9a1e2ff250 100644 --- a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md @@ -16,10 +16,7 @@ ms.date: 10/16/2017 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md index eade1924be..02dd96e4a2 100644 --- a/windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md @@ -16,10 +16,7 @@ ms.date: 05/08/2018 # Create and manage machine groups in Windows Defender ATP **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Azure Active Directory - Office 365 - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md index 3906ca3861..ace9334623 100644 --- a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-machinesview-abovefoldlink) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md index 4860f91956..ccf05baef8 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md index c090006878..46adcfac19 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 06/14/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md index 89eeee2c0e..9a359aaabc 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md index bae5b989f8..d3ed61a295 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md index 6db6e02136..1fa0357ade 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md index aee31bf368..84f62905aa 100644 --- a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -16,11 +16,6 @@ ms.date: 07/01/2018 # Minimum requirements for Windows Defender ATP **Applies to:** - -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) There are some minimum requirements for onboarding machines to the service. diff --git a/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md index 0b481a47f3..e39602997f 100644 --- a/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - macOS - Linux - Windows Server 2012 R2 diff --git a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md index bbee7b2a62..8a5aa4aef6 100644 --- a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md index ee949dfc75..b00153182b 100644 --- a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md @@ -15,10 +15,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md index cc40a22908..56837cc6fd 100644 --- a/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md index da8569a91a..7d817914ee 100644 --- a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md @@ -16,10 +16,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md index 244a09bc78..29ab4b8e88 100644 --- a/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md @@ -16,10 +16,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md index 8675655043..9327ab119c 100644 --- a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 07/30/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md index aab70fb694..3c91abd568 100644 --- a/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md index ec4e631bbb..f84794a823 100644 --- a/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md index 6c6e1ced73..89dc9b9545 100644 --- a/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md @@ -16,10 +16,7 @@ ms.date: 05/08/2018 # Manage portal access using role-based access control **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Azure Active Directory - Office 365 - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md index c2dc292025..b0a1826948 100644 --- a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md index c43c430a57..3a1a9732f3 100644 --- a/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 12/12/2017 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md index 8858ac7366..a5715dfd5d 100644 --- a/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 11/12/2017 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md index 87fe1b0b5c..9433c66921 100644 --- a/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 11/06/2017 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md index 47815df570..a0f45f3e98 100644 --- a/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md @@ -16,10 +16,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md index 8e9f3634dc..5af5257aaf 100644 --- a/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md index 656e809d15..aa84674ca6 100644 --- a/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md index b8bc903b76..d26b85defc 100644 --- a/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md index 9b235fa9b0..fb08668bbe 100644 --- a/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 03/06/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md index dc1b0cb21e..2a13e4676e 100644 --- a/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md index e9cb11bc67..745f2b34bb 100644 --- a/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 02/13/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md index be766d8d46..d86deb3f28 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 06/25/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md index eee538a7aa..3310063e5a 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 08/01/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index f9e7872493..ee87a156b5 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 04/24/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) - Windows Server 2012 R2 - Windows Server 2016 diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md index 9a63f9dc8b..9d2d0ee26a 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 02/13/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md index b8fed131a5..c45ead9ecd 100644 --- a/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md @@ -16,11 +16,6 @@ ms.date: 04/24/2018 # Use the threat intelligence API to create custom alerts **Applies to:** - -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) diff --git a/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md index 07cec03da7..3110ea4289 100644 --- a/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md @@ -17,10 +17,7 @@ ms.date: 03/12/2018 **Applies to:** -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education + - Windows Defender Advanced Threat Protection (Windows Defender ATP) From 2ba0c202a619976ad589b737bff25013c0d34b0b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 8 Aug 2018 15:44:13 -0700 Subject: [PATCH 042/286] toc updates --- windows/security/threat-protection/TOC.md | 3 +-- windows/security/threat-protection/windows-defender-atp/TOC.md | 3 ++- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 147feb3187..41beae5c7e 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -9,7 +9,6 @@ ### [Get started](get-started.md) | #### [Minimum requirements](windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md) #### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) #### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md) #### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) @@ -44,7 +43,7 @@ ##### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) ##### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) - +###### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 272883b96d..25ae0808d4 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -4,7 +4,7 @@ ## [Get started](../get-started.md) ### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) ### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) -### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) + ### [Preview features](preview-windows-defender-advanced-threat-protection.md) ### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) ### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) @@ -37,6 +37,7 @@ #### [Run simulated attacks on machines](attack-simulations-windows-defender-advanced-threat-protection.md) #### [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) #### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) ###[Configure Attack surface reduction](../configure1.md) From 58533be4890d882d6fa78f37d3da02132da135e4 Mon Sep 17 00:00:00 2001 From: Andrea Bichsel <35236577+andreabichsel@users.noreply.github.com> Date: Thu, 9 Aug 2018 10:55:36 -0700 Subject: [PATCH 043/286] Updates for content reorg. --- ...llect-diagnostic-data-update-compliance.md | 23 ++---- ...ne-arguments-windows-defender-antivirus.md | 30 ++------ ...nt-reference-windows-defender-antivirus.md | 30 +++----- ...d-scan-types-windows-defender-antivirus.md | 73 +++++++++---------- 4 files changed, 59 insertions(+), 97 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md b/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md index d0e001795a..b4c0e6729e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md +++ b/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md @@ -1,5 +1,5 @@ --- -title: Collect diagnostic data for Update Compliance and Windows Defender AV +title: Collect diagnostic data for Update Compliance and antivirus description: Use a tool to collect data to troubleshoot Update Compliance issues when using the Windows Defender AV Assessment add in keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, windows defender av search.product: eADQiWindows 10XVcnh @@ -16,18 +16,9 @@ ms.date: 09/12/2017 # Collect Update Compliance diagnostic data for Windows Defender AV Assessment -**Applies to:** - -- Windows 10 - -**Audience** - -- IT administrators - This topic describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Windows Defender AV Assessment section in the Update Compliance add-in. -Before attempting this process, ensure you have read the [Troubleshoot Windows Defender Antivirus reporting](troubleshoot-reporting.md) topic, met all require pre-requisites, and taken any other suggested troubleshooting steps. - +Before attempting this process, ensure you have read [Troubleshoot antivirus reporting](troubleshoot-reporting.md), met all require pre-requisites, and taken any other suggested troubleshooting steps. 1. On at least two endpoints that are not reporting or showing up in Update Compliance, obtain the .cab diagnostic file by following this process: @@ -57,20 +48,16 @@ Before attempting this process, ensure you have read the [Troubleshoot Windows D 3. Send an email using the Update Compliance support email template, and fill out the template with the following information: - ``` - I am encountering the following issue when using Windows Defender AV in Update Compliance: + I am encountering the following issue when using antivirus in Update Compliance: I have provided at least 2 support .cab files at the following location: - My OMS workspace ID is: + My OMS workspace ID is: - Please contact me at: + Please contact me at: ``` - - - ## Related topics - [Troubleshoot Windows Defender Antivirus reporting](troubleshoot-reporting.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md index 16ef07c3fd..497cc628fe 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Use the command line to manage Windows Defender AV -description: Windows Defender AV has a dedicated command-line utility that can run scans and configure protection. +title: Use the command line to manage antivirus +description: Run antivirus scans and configure next gen protection with a dedicated command-line utility. keywords: run windows defender scan, run antivirus scan from command line, run windows defender scan from command line, mpcmdrun, defender search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -11,31 +11,20 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 08/26/2017 +ms.date: 09/01/2018 --- +# Configure and manage antivirus with the mpcmdrun.exe command-line tool -# Use the mpcmdrun.exe command-line tool to configure and manage Windows Defender Antivirus +You can perform various antivirus functions with the dedicated command-line tool mpcmdrun.exe. -**Applies to:** +This utility can be useful when you want to automate antivirus use. -- Windows 10 - -**Audience** - -- Enterprise security administrators - - -You can use a dedicated command-line tool to perform various functions in Windows Defender Antivirus. - -This utility can be useful when you want to automate the use of Windows Defender Antivirus. - -The utility is available in _%ProgramFiles%\Windows Defender\MpCmdRun.exe_ and must be run from a command prompt. +You can find the utility in _%ProgramFiles%\Windows Defender\MpCmdRun.exe_. You must run it from a command prompt. > [!NOTE] > You may need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. - The utility has the following commands: ```DOS @@ -55,12 +44,7 @@ Command | Description \-ValidateMapsConnection | Used to validate connection to the [cloud-delivered protection service](configure-network-connections-windows-defender-antivirus.md) \-SignatureUpdate [-UNC [-Path ]] | Checks for new definition updates - - - ## Related topics - [Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) - - diff --git a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md index 09fefe72e5..91061f7f5f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md @@ -14,33 +14,25 @@ ms.author: v-anbic ms.date: 03/01/2018 --- -# Manage Windows Defender AV in your business +# Manage antivirus in your business -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators - -You can manage and configure Windows Defender Antivirus with the following tools: +You can manage and configure antivirus with the following tools: +- Microsoft Intune +- System Center Configuration Manager - Group Policy -- System Center Configuration Manager and Microsoft Intune - PowerShell cmdlets - Windows Management Instruction (WMI) - The mpcmdrun.exe utility -The topics in this section provide further information, links, and resources for using these tools in conjunction with Windows Defender AV. +The topics in this section provide further information, links, and resources for using these tools to manage and configure antivirus. ## In this section -Topic | Description +Topic | Description ---|--- -[Use Group Policy settings to configure and manage Windows Defender AV](use-group-policy-windows-defender-antivirus.md)|List of all Group Policy settings located in the Windows 10, version 1703 ADMX templates -[Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](use-intune-config-manager-windows-defender-antivirus.md)|Information on using System Center Configuration Manager and Microsoft Intune to deploy, manage, report, and configure Windows Defender AV -[Use PowerShell cmdlets to configure and manage Windows Defender AV](use-powershell-cmdlets-windows-defender-antivirus.md)|Instructions on using PowerShell cmdlets in the Defender Module and links to documentation for all cmdlets and allowed parameters -[Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](use-wmi-windows-defender-antivirus.md)| Instructions on using WMI to manage Windows Defender AV and links to documentation for the Windows Defender WMIv2 APIs (including all classes, methods, and properties) -[Use the mpcmdrun.exe command-line tool to configure and manage Windows Defender Antivirus](command-line-arguments-windows-defender-antivirus.md)|Instructions on using the dedicated command-line tool to manage and use Windows Defender AV - +[Manage antivirus with Microsoft Intune and System Center Configuration Manager](use-intune-config-manager-windows-defender-antivirus.md)|Information about using Intune and System Center Configuration Manager to deploy, manage, report, and configure antivirus +[Manage antivirus with Group Policy settings](use-group-policy-windows-defender-antivirus.md)|List of all Group Policy settings located in ADMX templates +[Manage antivirus with PowerShell cmdlets](use-powershell-cmdlets-windows-defender-antivirus.md)|Instructions for using PowerShell cmdlets to manage antivirus, plus links to documentation for all cmdlets and allowed parameters +[Manage antivirus with Windows Management Instrumentation (WMI)](use-wmi-windows-defender-antivirus.md)| Instructions for using WMI to manage antivirus, plus links to documentation for the WMIv2 APIs (including all classes, methods, and properties) +[Manage antivirus with the mpcmdrun.exe command-line tool](command-line-arguments-windows-defender-antivirus.md)|Instructions on using the dedicated command-line tool to manage and use antivirus diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md index 77cc805406..6cafcac89d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md @@ -15,38 +15,37 @@ ms.date: 07/10/2018 --- -# Configure scanning options in Windows Defender AV - - -**Applies to** -- Windows 10 - -**Audience** - -- Enterprise security administrators +# Configure antivirus scanning options **Manageability available with** +- Microsoft Intune +- System Center Configuration Manager - Group Policy - PowerShell - Windows Management Instrumentation (WMI) -- System Center Configuration Manager -- Microsoft Intune +**Use Microsoft Intune to configure scanning options** + +See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details. + + + +**Use Configuration Manager to configure scanning options:** + +See [How to create and deploy antimalware policies: Scan settings]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#scan-settings) for details on configuring System Center Configuration Manager (current branch). + +**Use Group Policy to configure scanning options** To configure the Group Policy settings described in the following table: -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below. +3. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below. -6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. - -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. - -For using WMI classes, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx). +4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. Description | Location and setting | Default setting (if not configured) | PowerShell `Set-MpPreference` parameter or WMI property for `MSFT_MpPreference` class ---|---|---|--- @@ -61,42 +60,42 @@ Specify the level of subfolders within an archive folder to scan | Scan > Specif Specify the maximum CPU load (as a percentage) during a scan. Note: This is not a hard limit but rather a guidance for the scanning engine to not exceed this maximum on average. | Scan > Specify the maximum percentage of CPU utilization during a scan | 50 | `-ScanAvgCPULoadFactor` Specify the maximum size (in kilobytes) of archive files that should be scanned. The default, **0**, applies no limit | Scan > Specify the maximum size of archive files to be scanned | No limit | Not available -**Use Configuration Manager to configure scanning options:** +**Use PowerShell to configure scanning options** -See [How to create and deploy antimalware policies: Scan settings]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#scan-settings) for details on configuring System Center Configuration Manager (current branch). +See [Manage antivirus with PowerShell cmdlets](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. +**Use WMI to configure scanning options** -**Use Microsoft Intune to configure scanning options** +For using WMI classes, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx). -See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details. - - - - ### Email scanning limitations + We recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware. Always-on protection scans emails as they arrive and as they are manipulated, just like normal files in the operating system. This provides the strongest form of protection and is the recommended setting for scanning emails. -You can use this Group Policy to also enable scanning of older email files used by Outlook 2003 and older during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated: +You can also use this Group Policy to enable scanning of older email files used by Outlook 2003 and older during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated: + - DBX - MBX - MIME PST files used by Outlook 2003 or older (where the archive type is set to non-unicode) can also be scanned, but Windows Defender cannot remediate threats detected inside PST files. This is another reason why we recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware. -If Windows Defender Antivirus detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat: -- Email subject -- Attachment name +If antivirus detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat: + +- Email subject +- Attachment name >[!WARNING] >There are some risks associated with scanning some Microsoft Outlook files and email messages. You can read about tips and risks associated with scanning Outlook files and email messages in the following articles: -- [Scanning Outlook files in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-1) -- [Scanning email messages in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-2) +> +> - [Scanning Outlook files in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-1) +> - [Scanning email messages in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-2) ## Related topics -- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) -- [Configure and run on-demand Windows Defender AV scans](run-scan-windows-defender-antivirus.md) -- [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Customize, initiate, and review the results of antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Configure and run on-demand antivirus scans](run-scan-windows-defender-antivirus.md) +- [Configure scheduled antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md) +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) From 295c33fb0ffd0e53552950591ee6e02e62ac7368 Mon Sep 17 00:00:00 2001 From: Andrea Bichsel <35236577+andreabichsel@users.noreply.github.com> Date: Thu, 9 Aug 2018 11:25:26 -0700 Subject: [PATCH 044/286] Edited block at first sight for content reorg. --- ...-first-sight-windows-defender-antivirus.md | 134 ++++++++---------- 1 file changed, 57 insertions(+), 77 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md index d5bdf282dc..96215ba4e6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md @@ -14,24 +14,15 @@ ms.author: v-anbic ms.date: 05/02/2018 --- -# Enable the Block at First Sight feature - -**Applies to** - -- Windows 10, version 1703 and later - -**Audience** - -- Enterprise security administrators +# Enable block at first sight **Manageability available with** -- Intune +- Microsoft Intune - Group Policy - Windows Defender Security Center app - -Block at first sight is a feature of Windows Defender Antivirus cloud-delivered protection that provides a way to detect and block new malware within seconds. +Block at first sight is a feature of next gen protection that provides a way to detect and block new malware within seconds. It is enabled by default when certain pre-requisite settings are also enabled. In most cases, these pre-requisite settings are also enabled by default, so the feature is running without any intervention. You can use group policy settings to confirm the feature is enabled. @@ -40,128 +31,117 @@ You can [specify how long the file should be prevented from running](configure-c You can also [customize the message displayed on users' desktops](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information) when a file is blocked. You can change the company name, contact information, and message URL. > [!IMPORTANT] -> There is no specific individual setting in System Center Configuration Manager to enable or disable Block at First Sight. It is enabled by default when the pre-requisite settings are configured correctly. You must use Group Policy settings to enable or disable the feature. - +> There is no specific individual setting in System Center Configuration Manager to enable or disable block at first sight. It is enabled by default when the pre-requisite settings are configured correctly. You must use Group Policy settings to enable or disable the feature. >[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work. - +>You can also visit the Windows Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work. ## How it works -When a Windows Defender Antivirus client encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend will apply heuristics, machine learning, and automated analysis of the file to determine the files as malicious or clean. +When antivirus encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend applies heuristics, machine learning, and automated analysis of the file to determine whether the files are malicious or clean. -In Windows 10, version 1803, the Block at First Sight feature can now block non-portable executable files (such as JS, VBS, or macros) as well as executable files. +In Windows 10, version 1803, block at first sight can now block non-portable executable files (such as JS, VBS, or macros) as well as executable files. -The Block at First Sight feature only uses the cloud protection backend for executable files and non-portable executable files that are downloaded from the Internet, or originating from the Internet zone. A hash value of the .exe file is checked via the cloud backend to determine if this is a previously undetected file. +Block at first sight only uses the cloud protection backend for executable files and non-portable executable files that are downloaded from the Internet, or that originate from the Internet zone. A hash value of the .exe file is checked via the cloud backend to determine if this is a previously undetected file. -If the cloud backend is unable to make a determination, the file will be locked by Windows Defender AV while a copy is uploaded to the cloud. The cloud will perform additional analysis to reach a determination before it allows the file to run or blocks it in all future encounters, depending on whether the file is determined to be malicious or safe. +If the cloud backend is unable to make a determination, antivirus locks the file and uploads a copy to the cloud. The cloud performs additional analysis to reach a determination before it either allows the file to run or blocks it in all future encounters, depending on whether it determines the file to be malicious or safe. -In many cases this process can reduce the response time for new malware from hours to seconds. +In many cases, this process can reduce the response time for new malware from hours to seconds. +## Confirm and validate that block at first sight is enabled -## Confirm and validate Block at First Sight is enabled +Block at first sight requires a number of Group Policy settings to be configured correctly or it will not work. These settings are enabled by default in most enterprise antivirus deployments. -Block at First Sight requires a number of Group Policy settings to be configured correctly or it will not work. Usually, these settings are already enabled in most default Windows Defender AV deployments in enterprise networks. - -### Confirm Block at First Sight is enabled with Intune +### Confirm block at first sight is enabled with Intune 1. In Intune, navigate to **Device configuration - Profiles > *Profile name* > Device restrictions > Windows Defender Antivirus**. - > [!NOTE] - > The profile you select must be a Device Restriction profile type, not an Endpoint Protection profile type. +> [!NOTE] +> The profile you select must be a Device Restriction profile type, not an Endpoint Protection profile type. 2. Verify these settings are configured as follows: - - **Cloud-delivered protection**: **Enable** - - **File Blocking Level**: **High** - - **Time extension for file scanning by the cloud**: **50** - - **Prompt users before sample submission**: **Send all data without prompting** + - **Cloud-delivered protection**: **Enable** + - **File Blocking Level**: **High** + - **Time extension for file scanning by the cloud**: **50** + - **Prompt users before sample submission**: **Send all data without prompting** -For more information about configuring Windows Defender AV device restrictions in Intune, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure). +For more information about configuring antivirus device restrictions in Intune, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure). -For a list of Windows Defender AV device restrictions in Intune, see [Device restriction for Windows 10 (and newer) settings in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus). +For a list of antivirus device restrictions in Intune, see [Device restriction for Windows 10 (and newer) settings in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus). +### Confirm block at first sight is enabled with Group Policy -### Confirm Block at First Sight is enabled with Group Policy +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +3. Expand the tree to **Windows components > Windows Defender Antivirus > MAPS** and configure the following Group Policies: -5. Expand the tree to **Windows components > Windows Defender Antivirus > MAPS** and configure the following Group Policies: - - 1. Double-click the **Join Microsoft MAPS** setting and ensure the option is set to **Enabled**. Click **OK**. - - 1. Double-click the **Send file samples when further analysis is required** setting and ensure the option is set to **Enabled** and the additional options are either of the following: - - 1. Send safe samples (1) - - 1. Send all samples (3) + 1. Double-click **Join Microsoft MAPS** and ensure the option is set to **Enabled**. Click **OK**. + + 2. Double-click **Send file samples when further analysis is required** and ensure the option is set to **Enabled** and the additional options are either of the following: + + - Send safe samples (1) + - Send all samples (3) > [!WARNING] - > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the "Block at First Sight" feature will not function. + > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means block at first sight will not function. - 1. Click **OK**. + 3. Click **OK**. -1. In the **Group Policy Management Editor**, expand the tree to **Windows components > Windows Defender Antivirus > Real-time Protection**: - - 1. Double-click the **Scan all downloaded files and attachments** setting and ensure the option is set to **Enabled**. Click **OK**. - - 1. Double-click the **Turn off real-time protection** setting and ensure the option is set to **Disabled**. Click **OK**. +4. In the **Group Policy Management Editor**, expand the tree to **Windows components > Windows Defender Antivirus > Real-time Protection**: + + 1. Double-click **Scan all downloaded files and attachments** and ensure the option is set to **Enabled**. Click **OK**. + + 2. Double-click **Turn off real-time protection** and ensure the option is set to **Disabled**. Click **OK**. If you had to change any of the settings, you should re-deploy the Group Policy Object across your network to ensure all endpoints are covered. +### Confirm block at first sight is enabled with the Windows Defender Security Center app -### Confirm Block at First Sight is enabled with the Windows Defender Security Center app +You can confirm that block at first sight is enabled in Windows Settings. -You can confirm that Block at First Sight is enabled in Windows Settings. - -The feature is automatically enabled as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. +Block at first sight is automatically enabled as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. **Confirm Block at First Sight is enabled on individual clients** -1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar. -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then click **Virus & threat protection settings**: ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center app](images/defender/wdav-protection-settings-wdsc.png) - -3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. + +3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. > [!NOTE] > If the pre-requisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. +### Validate block at first sight is working -### Validate Block at First Sight is working +You can validate that the feature is working by following the steps outlined in [Validate connections between your network and the cloud](configure-network-connections-windows-defender-antivirus.md#validate). -You can validate that the feature is working by following the steps outlined in the [Validate connections between your network and the cloud](configure-network-connections-windows-defender-antivirus.md#validate) topic. - - -## Disable Block at First Sight +## Disable block at first sight > [!WARNING] -> Disabling the Block at First Sight feature will lower the protection state of the endpoint and your network. +> Disabling block at first sight will lower the protection state of the endpoint and your network. -You may choose to disable the Block at First Sight feature if you want to retain the pre-requisite settings without using Block at First Sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network. +You may choose to disable block at first sight if you want to retain the pre-requisite settings without using block at first sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network. -**Disable Block at First Sight with Group Policy** +**Disable block at first sight with Group Policy** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree through **Windows components > Windows Defender Antivirus > MAPS**. +3. Expand the tree through **Windows components > Windows Defender Antivirus > MAPS**. -1. Double-click the **Configure the 'Block at First Sight' feature** setting and set the option to **Disabled**. +4. Double-click **Configure the 'Block at First Sight' feature** and set the option to **Disabled**. > [!NOTE] - > Disabling the Block at First Sight feature will not disable or alter the pre-requisite group policies. - + > Disabling block at first sight will not disable or alter the pre-requisite group policies. ## Related topics -- [Windows Defender in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) - [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) - - From f1baf9f360db65a3db560c6113dea389fc107b71 Mon Sep 17 00:00:00 2001 From: Andrea Bichsel <35236577+andreabichsel@users.noreply.github.com> Date: Thu, 9 Aug 2018 11:56:23 -0700 Subject: [PATCH 045/286] Edit cloud block timeout period --- ...meout-period-windows-defender-antivirus.md | 48 +++++-------------- 1 file changed, 12 insertions(+), 36 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md index 247e68bc23..a1e9d0c3a7 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md @@ -16,59 +16,35 @@ ms.date: 04/30/2018 # Configure the cloud block timeout period - - -**Applies to:** - -- Windows 10, version 1703 and later - -**Audience** - -- Enterprise security administrators - **Manageability available with** - Group Policy +When antivirus finds a suspicious file, it can prevent the file from running while it queries the [antivirus cloud service](utilize-microsoft-cloud-protection-windows-defender-antivirus.md). - - - - -When Windows Defender Antivirus is suspicious of a file, it can prevent the file from running while it queries the [Windows Defender Antivirus cloud-protection service](utilize-microsoft-cloud-protection-windows-defender-antivirus.md). - -The default period that the file will be [blocked](configure-block-at-first-sight-windows-defender-antivirus.md) for is 10 seconds. You can specify an additional period of time to wait before the file is allowed to run. This can help ensure there is enough time to receive a proper determination from the Windows Defender Antivirus cloud. - - +The default period that the file will be [blocked](configure-block-at-first-sight-windows-defender-antivirus.md) is 10 seconds. You can specify an additional period of time to wait before the file is allowed to run. This can help ensure there is enough time to receive a proper determination from the antivirus cloud service. ## Prerequisites to use the extended cloud block timeout -The [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature and its prerequisites must be enabled before you can specify an extended timeout period. - +[Block at first sight](configure-block-at-first-sight-windows-defender-antivirus.md) and its prerequisites must be enabled before you can specify an extended timeout period. + ## Specify the extended timeout period You can use Group Policy to specify an extended timeout for cloud checks. -**Use Group Policy to specify an extended timeout period:** +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +3. Expand the tree to **Windows components > Windows Defender Antivirus > MpEngine** -4. Expand the tree to **Windows components > Windows Defender Antivirus > MpEngine** - -5. Double-click the **Configure extended cloud check** setting and ensure the option is enabled. Specify the additional amount of time to prevent the file from running while waiting for a cloud determination. You can specify the additional time, in seconds, from 1 second to 50 seconds. This time will be added to the default 10 seconds. - -6. Click **OK**. +4. Double-click **Configure extended cloud check** and ensure the option is enabled. Specify the additional amount of time to prevent the file from running while waiting for a cloud determination. You can specify the additional time, in seconds, from 1 second to 50 seconds. This time will be added to the default 10 seconds. +5. Click **OK**. ## Related topics -- [Windows Defender in Windows 10](windows-defender-antivirus-in-windows-10.md) -- [Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -- [Configure the Block at First Sight feature](configure-block-at-first-sight-windows-defender-antivirus.md) +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Use next-gen antivirus technologies through cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +- [Configure block at first sight](configure-block-at-first-sight-windows-defender-antivirus.md) - [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) - - - - From f39da8158e4aac5c97d1a9bd1bdc5547b5e4a4b5 Mon Sep 17 00:00:00 2001 From: Andrea Bichsel <35236577+andreabichsel@users.noreply.github.com> Date: Thu, 9 Aug 2018 12:31:08 -0700 Subject: [PATCH 046/286] Content reorg and rebranding changes --- ...e-exclusions-windows-defender-antivirus.md | 146 +++++++----------- ...cy-overrides-windows-defender-antivirus.md | 58 +++---- 2 files changed, 76 insertions(+), 128 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md index 9381eb05f6..2d95ae1508 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- title: Configure and validate exclusions based on extension, name, or location -description: Exclude files from Windows Defender AV scans based on their file extension, file name, or location. +description: Exclude files from antivirus scans based on their file extension, file name, or location. keywords: exclusions, files, extension, file type, folder name, file name, scans search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -16,29 +16,18 @@ ms.date: 07/10/2018 # Configure and validate exclusions based on file extension and folder location - -**Applies to:** - -- Windows 10 -- Windows Server 2016 - -**Audience** - -- Enterprise security administrators - - **Manageability available with** +- Microsoft Intune +- System Center Configuration Manager - Group Policy - PowerShell - Windows Management Instrumentation (WMI) -- System Center Configuration Manager -- Microsoft Intune - Windows Defender Security Center -You can exclude certain files from being scanned by Windows Defender AV by modifying exclusion lists. +You can exclude certain files from antivirus scans by modifying exclusion lists. -Generally, you shouldn't need to apply exclusions. Windows Defender AV includes a number of automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. +Generally, you shouldn't need to apply exclusions. Antivirus includes a number of automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. >[!TIP] >The default antimalware policy we deploy at Microsoft doesn't set any exclusions by default. @@ -53,6 +42,7 @@ A specific file in a specific folder | The file c:\sample\sample.test only | Fil A specific process | The executable file c:\test\process.exe | File and folder exclusions This means the exclusion lists have the following characteristics: + - Folder exclusions will apply to all files and folders under that folder, unless the subfolder is a reparse point. Reparse point subfolders must be excluded separately. - File extensions will apply to any file name with the defined extension if a path or folder is not defined. @@ -61,70 +51,64 @@ This means the exclusion lists have the following characteristics: > >You cannot exclude mapped network drives. You must specify the actual network path. > ->Folders that are reparse points that are created after the Windows Defender AV service starts and that have been added to the exclusion list will not be included. You must restart the service (by restarting Windows) for new reparse points to be recognized as a valid exclusion target. - - - - -To exclude files opened by a specific process, see the [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) topic. +>Folders that are reparse points that are created after the antivirus service starts and that have been added to the exclusion list will not be included. You must restart the service (by restarting Windows) for new reparse points to be recognized as a valid exclusion target. +To exclude files opened by a specific process, see [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md). The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [real-time protection](configure-real-time-protection-windows-defender-antivirus.md). >[!IMPORTANT] ->Changes made via Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). +>Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). > >Changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists. - - -By default, local changes made to the lists (by users with administrator privileges; this includes changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in the case of conflicts. +By default, local changes made to the lists (by users with administrator privileges, including changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in case of conflicts. You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-windows-defender-antivirus.md#merge-lists) to allow local changes to override managed deployment settings. - - - - - ## Configure the list of exclusions based on folder name or file extension - +**Use Intune to configure file name, folder, or file extension exclusions:** + +See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details. + +**Use Configuration Manager to configure file name, folder, or file extension exclusions:** + +See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). + **Use Group Policy to configure folder or file extension exclusions:** >[!NOTE] ->If you specify a fully qualified path to a file, then only that file will be excluded. If a folder is defined in the exclusion, then all files and subdirectories under that folder will be excluded. +>If you specify a fully qualified path to a file, then only that file is excluded. If a folder is defined in the exclusion, then all files and subdirectories under that folder are excluded. -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. +3. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. - -6. Double-click the **Path Exclusions** setting and add the exclusions: +4. Double-click the **Path Exclusions** setting and add the exclusions: 1. Set the option to **Enabled**. - 2. Under the **Options** section, click **Show...** + 2. Under the **Options** section, click **Show...**. 3. Enter each folder on its own line under the **Value name** column. If you are entering a file, ensure you enter a fully qualified path to the file, including the drive letter, folder path, filename, and extension. Enter **0** in the **Value** column. -7. Click **OK**. +5. Click **OK**. -![The Group Policy setting for file and folder exclusions](images/defender/wdav-path-exclusions.png) + ![The Group Policy setting for file and folder exclusions](images/defender/wdav-path-exclusions.png) -8. Double-click the **Extension Exclusions** setting and add the exclusions: +6. Double-click the **Extension Exclusions** setting and add the exclusions: - 1. Set the option to **Enabled**. - 2. Under the **Options** section, click **Show...** + 1. Set the option to **Enabled**. + 2. Under the **Options** section, click **Show...**. 3. Enter each file extension on its own line under the **Value name** column. Enter **0** in the **Value** column. +7. Click **OK**. -9. Click **OK**. - -![The Group Policy setting for extension exclusions](images/defender/wdav-extension-exclusions.png) - + ![The Group Policy setting for extension exclusions](images/defender/wdav-extension-exclusions.png) + **Use PowerShell cmdlets to configure file name, folder, or file extension exclusions:** Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets and the appropriate exclusion list parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). @@ -139,9 +123,9 @@ The following are allowed as the \: Configuration action | PowerShell cmdlet ---|--- -Create or overwrite the list | `Set-MpPreference` -Add to the list | `Add-MpPreference` -Remove item from the list | `Remove-MpPreference` +Create or overwrite the list | `Set-MpPreference` +Add to the list | `Add-MpPreference` +Remove item from the list | `Remove-MpPreference` The following are allowed as the \: @@ -150,10 +134,8 @@ Exclusion type | PowerShell parameter All files with a specified file extension | `-ExclusionExtension` All files under a folder (including files in subdirectories), or a specific file | `-ExclusionPath` - >[!IMPORTANT] ->If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. - +>If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. For example, the following code snippet would cause Windows Defender AV scans to exclude any file with the **.test** file extension: @@ -161,8 +143,7 @@ For example, the following code snippet would cause Windows Defender AV scans to Add-MpPreference -ExclusionExtension ".test" ``` -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. - +See [Use PowerShell cmdlets to configure and run antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. **Use Windows Management Instruction (WMI) to configure file name, folder, or file extension exclusions:** @@ -176,25 +157,15 @@ ExclusionPath The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. See the following for more information and allowed parameters: + - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) -**Use Configuration Manager to configure file name, folder, or file extension exclusions:** - -See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). - - -**Use Microsoft Intune to configure file name, folder, or file extension exclusions:** - -See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details. - **Use the Windows Defender Security Center app to configure file name, folder, or file extension exclusions:** See [Add exclusions in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions) for instructions. - - ## Use wildcards in the file name and folder path or extension exclusion lists @@ -205,8 +176,7 @@ You can use the asterisk `*`, question mark `?`, or environment variables (such > >- Environment variable usage is limited to machine variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. >- You cannot use a wildcard in place of a drive letter. ->- The use of asterisk `*` in a folder exclusion will stand in place for a single folder. Use multiple instances of `\*\` to indicate multiple nested folders with unspecified names. - +>- An asterisk `*` in a folder exclusion will stand in place for a single folder. Use multiple instances of `\*\` to indicate multiple nested folders with unspecified names. The following table describes how the wildcards can be used and provides some examples. @@ -231,7 +201,7 @@ The following table describes how the wildcards can be used and provides some ex -
  1. C:\MyData\\notes.txt
  2. -
  3. Any file in: +
  4. Any file in:
    • C:\somepath\\Archives\Data and its subfolders
    • C:\somepath\\Authorized\Data and its subfolders
    • @@ -246,7 +216,7 @@ The following table describes how the wildcards can be used and provides some ex
- ? (question mark) + ? (question mark) Replaces a single character.
@@ -295,23 +265,23 @@ The following table describes how the wildcards can be used and provides some ex > >This argument, however, will not match any files in **subfolders** under *c:\data\final\marked* or *c:\data\review\marked*. - + ## Review the list of exclusions -You can retrieve the items in the exclusion list with PowerShell, [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune), or the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). +You can retrieve the items in the exclusion list with [Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune), [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), PowerShell, or the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). >[!IMPORTANT] ->Changes made via Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). +>Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). > >Changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists. If you use PowerShell, you can retrieve the list in two ways: -- Retrieve the status of all Windows Defender AV preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line. +- Retrieve the status of all antivirus preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line. - Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. -**Review the list of exclusions alongside all other Windows Defender AV preferences:** +**Review the list of exclusions alongside all other antivirus preferences:** Use the following cmdlet: @@ -320,13 +290,11 @@ Get-MpPreference ``` In the following example, the items contained in the `ExclusionExtension` list are highlighted: - ![PowerShell output for Get-MpPreference showing the exclusion list alongside other preferences](images/defender/wdav-powershell-get-exclusions-all.png) See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. - **Retrieve a specific exclusions list:** Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable: @@ -341,14 +309,10 @@ In the following example, the list is split into new lines for each use of the ` ![PowerShell output showing only the entries in the exclusion list](images/defender/wdav-powershell-get-exclusions-variable.png) - -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. - - - - +See [Use PowerShell cmdlets to configure and run antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. + ## Validate exclusions lists with the EICAR test file You can validate that your exclusion lists are working by using PowerShell with either the `Invoke-WebRequest` cmdlet or the .NET WebClient class to download a test file. @@ -359,11 +323,11 @@ In the following PowerShell snippet, replace *test.txt* with a file that conform Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt" ``` -If Windows Defender AV reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR testfile website](http://www.eicar.org/86-0-Intended-use.html). +If antivirus reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR testfile website](http://www.eicar.org/86-0-Intended-use.html). You can also use the following PowerShell code, which calls the .NET WebClient class to download the testfile - as with the `Invoke-WebRequest` cmdlet; replace *c:\test.txt* with a file that conforms to the rule you are validating: -```PowerShell +```PowerShell $client = new-object System.Net.WebClient $client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt") ``` @@ -376,12 +340,10 @@ If you do not have Internet access, you can create your own EICAR test file by w You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude. - - ## Related topics -- [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) +- [Configure and validate exclusions in antivirus scans](configure-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) -- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) -- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Configure antivirus exclusions on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) +- [Customize, initiate, and review the results of antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md index 55f4c3f930..a8b170b550 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md @@ -16,24 +16,15 @@ ms.date: 04/30/2018 # Prevent or allow users to locally modify Windows Defender AV policy settings -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators - **Manageability available with** - Group Policy - -By default, Windows Defender AV settings that are deployed via a Group Policy Object to the endpoints in your network will prevent users from locally changing the settings. You can change this in some instances. +By default, antivirus settings that are deployed via a Group Policy Object to the endpoints in your network will prevent users from locally changing the settings. You can change this in some instances. For example, it may be necessary to allow certain user groups (such as security researchers and threat investigators) further control over individual settings on the endpoints they use. -## Configure local overrides for Windows Defender AV settings +## Configure local overrides for antivirus settings The default setting for these policies is **Disabled**. @@ -43,25 +34,25 @@ The following table lists each of the override policy setting and the configurat To configure these settings: -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below. +3. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below. -6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. +4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. -7. Deploy the Group Policy Object as usual. +5. Deploy the Group Policy Object as usual. Location | Setting | Configuration topic ---|---|---|--- MAPS | Configure local setting override for reporting to Microsoft MAPS | [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) Quarantine | Configure local setting override for the removal of items from Quarantine folder | [Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) -Real-time protection | Configure local setting override for monitoring file and program activity on your computer | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) -Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) -Real-time protection | Configure local setting override for scanning all downloaded files and attachments | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) -Real-time protection | Configure local setting override for turn on behavior monitoring | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) -Real-time protection | Configure local setting override to turn on real-time protection | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for monitoring file and program activity on your computer | [Enable and configure antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | [Enable and configure antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for scanning all downloaded files and attachments | [Enable and configure antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for turn on behavior monitoring | [Enable and configure antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Configure local setting override to turn on real-time protection | [Enable and configure antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) Remediation | Configure local setting override for the time of day to run a scheduled full scan to complete remediation | [Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) Scan | Configure local setting override for maximum percentage of CPU utilization | [Configure and run scans](run-scan-windows-defender-antivirus.md) Scan | Configure local setting override for schedule scan day | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) @@ -69,35 +60,30 @@ Scan | Configure local setting override for scheduled quick scan time | [Configu Scan | Configure local setting override for scheduled scan time | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) Scan | Configure local setting override for the scan type to use for a scheduled scan | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) - - - - + ## Configure how locally and globally defined threat remediation and exclusions lists are merged You can also configure how locally defined lists are combined or merged with globally defined lists. This setting applies to [exclusion lists](configure-exclusions-windows-defender-antivirus.md) and [specified remediation lists](configure-remediation-windows-defender-antivirus.md). -By default, lists that have been configured in local group policy and the Windows Defender Security Center app are merged with lists that are defined by the appropriate GPO that you have deployed on your network. Where there are conflicts, the globally defined list takes precedence. - -You can disable this setting to ensure that only globally defined lists (such as those from any deployed GPOs) are used. +By default, lists that have been configured in local group policy and the Windows Defender Security Center app are merged with lists that are defined by the appropriate Group Policy Object that you have deployed on your network. Where there are conflicts, the globally-defined list takes precedence. +You can disable this setting to ensure that only globally-defined lists (such as those from any deployed GPOs) are used. **Use Group Policy to disable local list merging:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus**. +3. Expand the tree to **Windows components > Windows Defender Antivirus**. -6. Double-click the **Configure local administrator merge behavior for lists** setting and set the option to **Enabled**. Click **OK**. +4. Double-click **Configure local administrator merge behavior for lists** and set the option to **Enabled**. Click **OK**. > [!NOTE] -> If you disable local list merging, it will override Controlled folder access settings in Windows Defender Exploit Guard. It also overrides any protected folders or allowed apps set by the local administrator. For more information about Controlled folder access settings, see [Enable Controlled folder access](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard). - +> If you disable local list merging, it will override controlled folder access settings. It also overrides any protected folders or allowed apps set by the local administrator. For more information about controlled folder access settings, see [Enable controlled folder access](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard). ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) -- [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-windows-defender-antivirus.md) \ No newline at end of file +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Configure end-user interaction with antivirus](configure-end-user-interaction-windows-defender-antivirus.md) From 70fb7062d0f0d9108829255c3154d6113f2350d4 Mon Sep 17 00:00:00 2001 From: Andrea Bichsel <35236577+andreabichsel@users.noreply.github.com> Date: Thu, 9 Aug 2018 13:02:07 -0700 Subject: [PATCH 047/286] Content reorg and rebranding changes. --- ...-interaction-windows-defender-antivirus.md | 18 +-- ...e-exclusions-windows-defender-antivirus.md | 30 ++--- ...-connections-windows-defender-antivirus.md | 81 ++++++------- ...otifications-windows-defender-antivirus.md | 71 +++++------ ...e-exclusions-windows-defender-antivirus.md | 114 +++++++----------- 5 files changed, 121 insertions(+), 193 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md index 8ff899a974..f5bc23d01b 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md @@ -14,28 +14,20 @@ ms.author: v-anbic ms.date: 08/26/2017 --- -# Configure end-user interaction with Windows Defender Antivirus - -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators +# Configure end-user interaction with antivirus **Manageability available with** - Group Policy -You can configure how users of the endpoints on your network can interact with Windows Defender Antivirus. +You can configure how users of the endpoints on your network can interact with antivirus. -This includes whether they see the Windows Defender AV interface, what notifications they see, and if they can locally override globally deployed Group Policy settings. +This includes whether they see the antivirus interface, what notifications they see, and if they can locally override globally-deployed Group Policy settings. ## In this section Topic | Description ---|--- -[Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) | Configure and customize additional notifications, customized text for notifications, and notifications about reboots for remediation -[Prevent users from seeing or interacting with the Windows Defender AV user interface](prevent-end-user-interaction-windows-defender-antivirus.md) | Hide the user interface from users +[Configure notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) | Configure and customize additional notifications, customized text for notifications, and notifications about reboots for remediation +[Prevent users from seeing or interacting with the antivirus user interface](prevent-end-user-interaction-windows-defender-antivirus.md) | Hide the user interface from users [Prevent users from locally modifying policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) | Prevent (or allow) users from overriding policy settings on their individual endpoints diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md index ce689900bf..0f91b5467e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md @@ -14,44 +14,32 @@ ms.author: v-anbic ms.date: 07/27/2017 --- -# Configure and validate exclusions for Windows Defender AV scans (client) - - -**Applies to:** - -- Windows 10 -- Windows Server 2016 - -**Audience** - -- Enterprise security administrators - +# Configure and validate exclusions for antivirus **Manageability available with** +- Microsoft Intune +- System Center Configuration Manager - Group Policy - PowerShell - Windows Management Instrumentation (WMI) -- System Center Configuration Manager -- Microsoft Intune - Windows Defender Security Center -You can exclude certain files, folders, processes, and process-opened files from being scanned by Windows Defender Antivirus. +You can exclude certain files, folders, processes, and process-opened files from antivirus scans. The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). Exclusions for process-opened files only apply to real-time protection. Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization. -Windows Server 2016 also features automatic exclusions that are defined by the server roles you enable. See the [Windows Defender AV exclusions on Windows Server 2016](configure-server-exclusions-windows-defender-antivirus.md) topic for more information and a list of the automatic exclusions. +Windows Server 2016 also features automatic exclusions that are defined by the server roles you enable. See the [Antivirus exclusions on Windows Server 2016](configure-server-exclusions-windows-defender-antivirus.md) topic for more information and a list of the automatic exclusions. >[!WARNING] ->Defining exclusions lowers the protection offered by Windows Defender AV. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious. +>Defining exclusions lowers the protection offered by antivirus. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious. ## In this section Topic | Description ---|--- -[Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) | Exclude files from Windows Defender AV scans based on their file extension, file name, or location -[Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) | You can exclude files from scans that have been opened by a specific process -[Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) | Windows Server 2016 includes automatic exclusions, based on the defined Server Role. You can also add custom exclusions - +[Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) | Exclude files from antivirus scans based on their file extension, file name, or location +[Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) | Exclude files from scans that have been opened by a specific process +[Configure antivirus exclusions on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) | Windows Server 2016 includes automatic exclusions, based on the defined server role. You can also add custom exclusions. diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md index b4751e5cad..2c14460ca1 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md @@ -1,7 +1,7 @@ --- -title: Configure and test Windows Defender Antivirus network connections -description: Configure and test your connection to the Windows Defender Antivirus cloud-delivered protection service. -keywords: windows defender antivirus, antimalware, security, defender, cloud, aggressiveness, protection level +title: Configure and validate antivirus network connections +description: Configure and test your connection to the antivirus cloud protection service. +keywords: antivirus, windows defender antivirus, antimalware, security, defender, cloud, aggressiveness, protection level search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -14,38 +14,29 @@ ms.author: v-anbic ms.date: 04/30/2018 --- -# Configure and validate network connections for Windows Defender Antivirus +# Configure and validate antivirus network connections - -**Applies to:** - -- Windows 10 (some instructions are only applicable for Windows 10, version 1703 or later) - -**Audience** - -- Enterprise security administrators - - -To ensure Windows Defender Antivirus cloud-delivered protection works properly, you need to configure your network to allow connections between your endpoints and certain Microsoft servers. +To ensure antivirus cloud-delivered protection works properly, you need to configure your network to allow connections between your endpoints and certain Microsoft servers. This topic lists the connections that must be allowed, such as by using firewall rules, and provides instructions for validating your connection. This will help ensure you receive the best protection from our cloud-delivered protection services. See the Enterprise Mobility and Security blog post [Important changes to Microsoft Active Protection Services endpoint](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/important-changes-to-microsoft-active-protection-service-maps-endpoint/) for some details about network connectivity. >[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working: +>You can also visit the Windows Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working: +> >- Cloud-delivered protection ->- Fast learning (including Block at first sight) +>- Fast learning (including block at first sight) >- Potentially unwanted application blocking -## Allow connections to the Windows Defender Antivirus cloud +## Allow connections to the antivirus cloud service -The Windows Defender Antivirus cloud provides fast, strong protection for your endpoints. Enabling the cloud-delivered protection service is optional, however it is highly recommend as it provides very important protection against malware on your endpoints and across your network. +The antivirus cloud service provides fast, strong protection for your endpoints. Enabling the cloud-delivered protection service is optional, however it is highly recommended because it provides very important protection against malware on your endpoints and across your network. ->[!NOTE] ->The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional signature updates. +>[!NOTE] +>The antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional signature updates. -See the [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) topic for details on enabling the service with Group Policy, System Center Configuration Manager, PowerShell cmdlets, Microsoft Intune, or on individual clients in the Windows Defender Security Center app. +See [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) for details on enabling the service with Intune, System Center Configuration Manager, Group Policy, PowerShell cmdlets, or on individual clients in the Windows Defender Security Center app. After you've enabled the service, you may need to configure your network or firewall to allow connections between it and your endpoints. @@ -59,10 +50,10 @@ The following table lists the services and their associated URLs that your netwo
- Windows Defender Antivirus cloud-delivered protection service, also referred to as Microsoft Active Protection Service (MAPS) + Antivirus cloud-delivered protection service, also referred to as Microsoft Active Protection Service (MAPS) - Used by Windows Defender Antivirus to provide cloud-delivered protection + Used by antivirus to provide cloud-delivered protection *.wdcp.microsoft.com*
@@ -85,7 +76,7 @@ Signature and product updates Definition updates alternate download location (ADL)
- Alternate location for Windows Defender Antivirus definition updates if the installed definitions fall out of date (7 or more days behind) + Alternate location for antivirus definition updates if the installed definitions fall out of date (7 or more days behind) *.download.microsoft.com @@ -122,7 +113,7 @@ http://www.microsoft.com/pki/certs Symbol Store -Used by Windows Defender Antivirus to restore certain critical files during remediation flows +Used by antivirus to restore certain critical files during remediation flows https://msdl.microsoft.com/download/symbols @@ -133,46 +124,45 @@ https://msdl.microsoft.com/download/symbols Universal Telemetry Client -Used by Windows to send client diagnostic data, Windows Defender Antivirus uses this for product quality monitoring purposes +Used by Windows to send client diagnostic data; antivirus uses this for product quality monitoring purposes This update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints:
  • vortex-win.data.microsoft.com
  • settings-win.data.microsoft.com
- ## Validate connections between your network and the cloud -After whitelisting the URLs listed above, you can test if you are connected to the Windows Defender AV cloud and are correctly reporting and receiving information to ensure you are fully protected. +After whitelisting the URLs listed above, you can test if you are connected to the antivirus cloud service and are correctly reporting and receiving information to ensure you are fully protected. **Use the cmdline tool to validate cloud-delivered protection:** -Use the following argument with the Windows Defender AV command line utility (*mpcmdrun.exe*) to verify that your network can communicate with the Windows Defender AV cloud: +Use the following argument with the antivirus command line utility (*mpcmdrun.exe*) to verify that your network can communicate with the antivirus cloud service: ```DOS -MpCmdRun -ValidateMapsConnection +MpCmdRun -ValidateMapsConnection ``` -> [!NOTE] -> You need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. This command will only work on Windows 10, version 1703. -See [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender Antivirus](command-line-arguments-windows-defender-antivirus.md) for more information on how to use the *mpcmdrun.exe* utility. +> [!NOTE] +> You need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. This command will only work on Windows 10, version 1703 or higher. + +See [Mange antivirus with the mpcmdrun.exe commandline tool](command-line-arguments-windows-defender-antivirus.md) for more information on how to use the *mpcmdrun.exe* utility. **Attempt to download a fake malware file from Microsoft:** -You can download a sample file that Windows Defender AV will detect and block if you are properly connected to the cloud. +You can download a sample file that antivirus will detect and block if you are properly connected to the cloud. Download the file by visiting the following link: - http://aka.ms/ioavtest ->[!NOTE] +>[!NOTE] >This file is not an actual piece of malware. It is a fake file that is designed to test if you are properly connected to the cloud. -If you are properly connected, you will see a warning notification from Windows Defender Antivirus: +If you are properly connected, you will see a warning antivirus notification: -![Windows Defender Antivirus notification informing the user that malware was found](images/defender/wdav-malware-detected.png) +![Antivirus notification informing the user that malware was found](images/defender/wdav-malware-detected.png) If you are using Microsoft Edge, you'll also see a notification message: @@ -180,7 +170,7 @@ If you are using Microsoft Edge, you'll also see a notification message: A similar message occurs if you are using Internet Explorer: -![Windows Defender Antivirus notification informing the user that malware was found](images/defender/wdav-bafs-ie.png) +![Antivirus notification informing the user that malware was found](images/defender/wdav-bafs-ie.png) You will also see a detection under **Quarantined threats** in the **Scan history** section in the Windows Defender Security Center app: @@ -189,23 +179,22 @@ You will also see a detection under **Quarantined threats** in the **Scan histor 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Scan history** label: ![Screenshot of the Scan history label in the Windows Defender Security Center app](images/defender/wdav-history-wdsc.png) - + 3. Under the **Quarantined threats** section, click the **See full history** label to see the detected fake malware: ![Screenshot of quarantined items in the Windows Defender Security Center app](images/defender/wdav-quarantined-history-wdsc.png) >[!NOTE] ->Versions of Windows 10 before version 1703 have a different user interface. See the [Windows Defender Antivirus in the Windows Defender Security Center](windows-defender-security-center-antivirus.md) topic for more information about the differences between versions, and instructions on how to perform common tasks in the different interfaces. +>Versions of Windows 10 before version 1703 have a different user interface. See [Antivirus in the Windows Defender Security Center](windows-defender-security-center-antivirus.md) for more information about the differences between versions, and instructions on how to perform common tasks in the different interfaces. The Windows event log will also show [Windows Defender client event ID 2050](troubleshoot-windows-defender-antivirus.md). >[!IMPORTANT] ->You will not be able to use a proxy auto-config (.pac) file to test network connections to these URLs. You will need to verify your proxy servers and any network filtering tools manually to ensure connectivity. - +>You will not be able to use a proxy auto-config (.pac) file to test network connections to these URLs. You will need to verify your proxy servers and any network filtering tools manually to ensure connectivity. ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) - [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) -- [Run a Windows Defender scan from the command line](command-line-arguments-windows-defender-antivirus.md) and [Command line arguments](command-line-arguments-windows-defender-antivirus.md) +- [Run an antivirus scan from the command line](command-line-arguments-windows-defender-antivirus.md) and [Command line arguments](command-line-arguments-windows-defender-antivirus.md) - [Important changes to Microsoft Active Protection Services endpoint](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/important-changes-to-microsoft-active-protection-service-maps-endpoint/) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md index 060372f38b..d6ae8d8549 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md @@ -1,7 +1,7 @@ --- -title: Configure notifications for Windows Defender Antivirus -description: Configure and customize notifications from Windows Defender AV. -keywords: notifications, defender, endpoint, management, admin +title: Configure antivirus notifications +description: Configure and customize antivirus notifications. +keywords: notifications, defender, antivirus, endpoint, management, admin search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -16,22 +16,14 @@ ms.date: 04/30/2018 # Configure the notifications that appear on endpoints -**Applies to:** - -- Windows 10, version 1703 and later - -**Audience** - -- Enterprise security administrators - **Manageability available with** - Group Policy - Windows Defender Security Center app -In Windows 10, application notifications about malware detection and remediation by Windows Defender are more robust, consistent, and concise. +In Windows 10, application notifications about malware detection and remediation are more robust, consistent, and concise. -Notifications will appear on endpoints when manually triggered and scheduled scans are completed and threats are detected. These notifications will also be seen in the **Notification Center**, and a summary of scans and threat detections will also appear at regular time intervals. +Notifications appear on endpoints when manually triggered and scheduled scans are completed and threats are detected. These notifications also appear in the **Notification Center**, and a summary of scans and threat detections appear at regular time intervals. You can also configure how standard notifications appear on endpoints, such as notifications for reboot or when a threat has been detected and remediated. @@ -40,78 +32,73 @@ You can also configure how standard notifications appear on endpoints, such as n You can configure the display of additional notifications, such as recent threat detection summaries, in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md) and with Group Policy. > [!NOTE] -> In Windows 10, version 1607 the feature was called **Enhanced notifications** and could be configured under **Windows Settings** > **Update & security** > **Windows Defender**. In Group Policy settings in all versions of Windows 10 it is called **Enhanced notifications**. +> In Windows 10, version 1607 the feature was called **Enhanced notifications** and could be configured under **Windows Settings** > **Update & security** > **Windows Defender**. In Group Policy settings in all versions of Windows 10, it is called **Enhanced notifications**. > [!IMPORTANT] > Disabling additional notifications will not disable critical notifications, such as threat detection and remediation alerts. -**Use the Windows Defender Security Center app to disable additional notifications:** +**Use the Windows Defender Security Center app to disable additional notifications:** 1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: -![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](images/defender/wdav-protection-settings-wdsc.png) - -3. Scroll to the **Notifications** section and click **Change notification settings**. + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center](images/defender/wdav-protection-settings-wdsc.png) + +3. Scroll to the **Notifications** section and click **Change notification settings**. 4. Slide the switch to **Off** or **On** to disable or enable additional notifications. **Use Group Policy to disable additional notifications:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. -4. Click **Administrative templates**. +3. Click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Reporting**. - -6. Double-click the **Turn off enhanced notifications** setting and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. +4. Expand the tree to **Windows components > Windows Defender Antivirus > Reporting**. +5. Double-click **Turn off enhanced notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. ## Configure standard notifications on endpoints You can use Group Policy to: + - Display additional, customized text on endpoints when the user needs to perform an action - Hide all notifications on endpoints - Hide reboot notifications on endpoints -Hiding notifications can be useful in situations where you cannot hide the entire Windows Defender AV interface. See [Prevent users from seeing or interacting with the Windows Defender AV user interface](prevent-end-user-interaction-windows-defender-antivirus.md) for more information. +Hiding notifications can be useful in situations where you can't hide the entire antivirus interface. See [Prevent users from seeing or interacting with the antivirus user interface](prevent-end-user-interaction-windows-defender-antivirus.md) for more information. > [!NOTE] > Hiding notifications will only occur on endpoints to which the policy has been deployed. Notifications related to actions that must be taken (such as a reboot) will still appear on the [System Center Configuration Manager Endpoint Protection monitoring dashboard and reports](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection). -See the [Customize the Windows Defender Security Center app for your organization](/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md) topic for instructions to add custom contact information to the notifications that users see on their machines. +See [Customize the Windows Defender Security Center app for your organization](/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md) for instructions to add custom contact information to the notifications that users see on their machines. **Use Group Policy to hide notifications:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure, and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Client interface**. +3. Expand the tree to **Windows components > Windows Defender Antivirus > Client interface**. -6. Double-click the **Suppress all notifications** setting and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. +4. Double-click **Suppress all notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. **Use Group Policy to hide reboot notifications:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Client interface**. - -6. Double-click the **Suppresses reboot notifications** setting and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. - +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. +3. Click **Administrative templates**. +4. Expand the tree to **Windows components > Windows Defender Antivirus > Client interface**. +5. Double-click **Suppresses reboot notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) -- [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-windows-defender-antivirus.md) +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Configure end-user interaction with antivirus](configure-end-user-interaction-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md index 43501a9510..4c2d5034b6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -1,7 +1,7 @@ --- title: Configure exclusions for files opened by specific processes description: You can exclude files from scans if they have been opened by a specific process. -keywords: process, exclusion, files, scans +keywords: antivirus, process, exclusion, files, scans search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -16,78 +16,73 @@ ms.date: 07/10/2018 # Configure exclusions for files opened by processes -**Applies to:** - -- Windows 10 -- Windows Server 2016 - -**Audience** - -- Enterprise security administrators - - **Manageability available with** +- Microsoft Intune +- System Center Configuration Manager - Group Policy - PowerShell - Windows Management Instrumentation (WMI) -- System Center Configuration Manager -- Microsoft Intune - Windows Defender Security Center -You can exclude files that have been opened by specific processes from being scanned by Windows Defender AV. +You can exclude files that have been opened by specific processes from antivirus scans. This topic describes how to configure exclusion lists for the following: -Exclusion | Example +Exclusion | Example ---|--- Any file on the machine that is opened by any process with a specific file name | Specifying "test.exe" would exclude files opened by:
  • c:\sample\test.exe
  • d:\internal\files\test.exe
Any file on the machine that is opened by any process under a specific folder | Specifying "c:\test\sample\\*" would exclude files opened by:
  • c:\test\sample\test.exe
  • c:\test\sample\test2.exe
  • c:\test\sample\utility.exe
Any file on the machine that is opened by a specific process in a specific folder | Specifying "c:\test\process.exe" would exclude files only opened by c:\test\process.exe -When you add a process to the process exclusion list, Windows Defender AV will not scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md). +When you add a process to the process exclusion list, antivirus won't scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md). -The exclusions only apply to [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). They do not apply to scheduled or on-demand scans. +The exclusions only apply to [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). They don't apply to scheduled or on-demand scans. -Changes made via Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). However, changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists. +Changes made with Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). However, changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists. You can add, remove, and review the lists for exclusions in [Group Policy](#gp), [System Center Configuration Manager, Microsoft Intune, and with the Windows Defender Security Center app](#man-tools), and you can [use wildcards](#wildcards) to further customize the lists. -You can also [use PowerShell cmdlets and WMI to configure the exclusion lists](#ps), including [reviewing](#review) your lists. +You can also [use PowerShell cmdlets and WMI to configure the exclusion lists](#ps), including [reviewing](#review) your lists. - -By default, local changes made to the lists (by users with administrator privileges; this includes changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in the case of conflicts. +By default, local changes made to the lists (by users with administrator privileges; this includes changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in the case of conflicts. You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-windows-defender-antivirus.md#merge-lists) to allow local changes to override managed deployment settings. - ## Configure the list of exclusions for files opened by specified processes - + +**Use Microsoft Intune to exclude files that have been opened by specified processes from scans:** + +See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details. + +**Use System Center Configuration Manager to exclude files that have been opened by specified processes from scans:** + +See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). + **Use Group Policy to exclude files that have been opened by specified processes from scans:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. +3. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. +4. Double-click **Process Exclusions** and add the exclusions: -6. Double-click the **Process Exclusions** setting and add the exclusions: - - 1. Set the option to **Enabled**. - 2. Under the **Options** section, click **Show...** + 1. Set the option to **Enabled**. + 2. Under the **Options** section, click **Show...**. 3. Enter each process on its own line under the **Value name** column. See the [example table](#examples) for the different types of process exclusions. Enter **0** in the **Value** column for all processes. -7. Click **OK**. +5. Click **OK**. ![The Group Policy setting for specifying process exclusions](images/defender/wdav-process-exclusions.png) - + **Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans:** Using PowerShell to add or remove exclusions for files that have been opened by processes requires using a combination of three cmdlets with the `-ExclusionProcess` parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). @@ -102,14 +97,12 @@ The following are allowed as the \: Configuration action | PowerShell cmdlet ---|--- -Create or overwrite the list | `Set-MpPreference` -Add to the list | `Add-MpPreference` -Remove items from the list | `Remove-MpPreference` - +Create or overwrite the list | `Set-MpPreference` +Add to the list | `Add-MpPreference` +Remove items from the list | `Remove-MpPreference` >[!IMPORTANT] ->If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. - +>If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by the specified process: @@ -117,9 +110,7 @@ For example, the following code snippet would cause Windows Defender AV scans to Add-MpPreference -ExclusionProcess "c:\internal\test.exe" ``` - -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. - +See [Manage antivirus with PowerShell cmdlets](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with antivirus. **Use Windows Management Instruction (WMI) to exclude files that have been opened by specified processes from scans:** @@ -132,26 +123,17 @@ ExclusionProcess The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. See the following for more information and allowed parameters: + - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) -**Use Configuration Manager to exclude files that have been opened by specified processes from scans:** - -See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). - - -**Use Microsoft Intune to exclude files that have been opened by specified processes from scans:** - -See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details. - **Use the Windows Defender Security Center app to exclude files that have been opened by specified processes from scans:** See [Add exclusions in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions) for instructions. - - + ## Use wildcards in the process exclusion list The use of wildcards in the process exclusion list is different from their use in other exclusion lists. @@ -166,20 +148,18 @@ Wildcard | Use | Example use | Example matches ? (question mark) | Not available | \- | \- Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles\file.exe
|
  • Any file opened by C:\ProgramData\CustomLogFiles\file.exe
- - - + ## Review the list of exclusions You can retrieve the items in the exclusion list with PowerShell, [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure), or the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). If you use PowerShell, you can retrieve the list in two ways: -- Retrieve the status of all Windows Defender AV preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line. +- Retrieve the status of all antivirus preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line. - Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. -**Review the list of exclusions alongside all other Windows Defender AV preferences:** +**Review the list of exclusions alongside all other antivirus preferences:** Use the following cmdlet: @@ -187,9 +167,7 @@ Use the following cmdlet: Get-MpPreference ``` - -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. - +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with antivirus. **Retrieve a specific exclusions list:** @@ -200,18 +178,12 @@ $WDAVprefs = Get-MpPreference $WDAVprefs.ExclusionProcess ``` - - -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. - - - - +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with antivirus. ## Related topics -- [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) +- [Configure and validate exclusions in antivirus scans](configure-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) -- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) -- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file +- [Configure antivirus exclusions on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) +- [Customize, initiate, and review the results of antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) From a62b0855f19f144d990956576109c437ddc37125 Mon Sep 17 00:00:00 2001 From: Andrea Bichsel <35236577+andreabichsel@users.noreply.github.com> Date: Thu, 9 Aug 2018 14:23:01 -0700 Subject: [PATCH 048/286] Content reorg and rebranding changes --- ...ion-features-windows-defender-antivirus.md | 23 ++---- ...e-protection-windows-defender-antivirus.md | 70 ++++++------------- 2 files changed, 29 insertions(+), 64 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md index 8eaf0cfc8f..64287e7230 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Enable and configure protection features in Windows Defender AV +title: Enable and configure antivirus protection features description: Enable behavior-based, heuristic, and real-time protection in Windows Defender AV. keywords: heuristic, machine-learning, behavior monitor, real-time protection, always-on, windows defender antivirus, antimalware, security, defender search.product: eADQiWindows 10XVcnh @@ -16,30 +16,21 @@ ms.date: 08/26/2017 # Configure behavioral, heuristic, and real-time protection -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators - -Windows Defender Antivirus uses several methods to provide threat protection: +Antivirus uses several methods to provide threat protection: - Cloud-delivered protection for near-instant detection and blocking of new and emerging threats - Always-on scanning, using file and process behavior monitoring and other heuristics (also known as "real-time protection") - Dedicated protection updates based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research -You can configure how Windows Defender AV uses these methods with Group Policy, System Center Configuration Manage, PowerShell cmdlets, and Windows Management Instrumentation (WMI). +You can configure how antivirus uses these methods with Group Policy, System Center Configuration Manage, PowerShell cmdlets, and Windows Management Instrumentation (WMI). -This section covers configuration for always-on scanning, including how to detect and block apps that are deemed unsafe, but may not be detected as malware. - -See the [Utilize Microsoft cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) section for how to enable and configure Windows Defender AV cloud-delivered protection. +This section covers configuration for always-on scanning, including how to detect and block apps that are deemed unsafe, but may not be detected as malware. +See [Use next-gen antivirus technologies through cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for how to enable and configure antivirus cloud-delivered protection. ## In this section - Topic | Description + Topic | Description ---|--- [Detect and block potentially unwanted applications](detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) | Detect and block apps that may be unwanted in your network, such as adware, browser modifiers and toolbars, and rogue or fake antivirus apps -[Enable and configure Windows Defender AV protection capabilities](configure-real-time-protection-windows-defender-antivirus.md) | Enable and configure real-time protection, heuristics, and other always-on antivirus monitoring features \ No newline at end of file +[Enable and configure antivirus protection capabilities](configure-real-time-protection-windows-defender-antivirus.md) | Enable and configure real-time protection, heuristics, and other always-on antivirus monitoring features \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md index d97f720028..61d07598c0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md @@ -1,7 +1,7 @@ --- -title: Configure always-on real-time protection in Windows Defender AV -description: Enable and configure real-time protection features such as behavior monitoring, heuristics, and machine-learning in Windows Defender AV -keywords: real-time protection, rtp, machine-learning, behavior monitoring, heuristics +title: Configure always-on real-time antivirus protection +description: Enable and configure antivirus real-time protection features such as behavior monitoring, heuristics, and machine-learning +keywords: antivirus, real-time protection, rtp, machine-learning, behavior monitoring, heuristics search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -14,66 +14,42 @@ ms.author: v-anbic ms.date: 04/30/2018 --- - - -# Enable and configure Windows Defender AV always-on protection and monitoring - - - -**Applies to:** - -- Windows 10 - - -**Audience** - -- Enterprise security administrators - +# Enable and configure antivirius always-on protection and monitoring **Manageability available with** - Group Policy - - - -Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities. +Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities. These activities include events such as processes making unusual changes to existing files, modifying or creating automatic startup registry keys and startup locations (also known as auto-start extensibility points, or ASEPs), and other changes to the file system or file structure. - ## Configure and enable always-on protection You can configure how always-on protection works with the Group Policy settings described in this section. To configure these settings: -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below. - -6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +3. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below. +4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK** and repeat for any other settings. Location | Setting | Description | Default setting (if not configured) ---|---|---|--- -Real-time protection | Monitor file and program activity on your computer | The AV engine makes note of any file changes (file writes, such as moves, copies, or modifications) and general program activity (programs that are opened or running and that cause other programs to run) | Enabled -Real-time protection | Scan all downloaded files and attachments | Downloaded files and attachments are automatically scanned. This operates in addition to Windows Defender SmartScreen filter, which scans files before and during downloading | Enabled -Real-time protection | Turn on process scanning whenever real-time protection is enabled | You can independently enable the AV engine to scan running processes for suspicious modifications or behaviors. This is useful if you have disabled real-time protection | Enabled +Real-time protection | Monitor file and program activity on your computer | The antivirus engine makes note of any file changes (file writes, such as moves, copies, or modifications) and general program activity (programs that are opened or running and that cause other programs to run) | Enabled +Real-time protection | Scan all downloaded files and attachments | Downloaded files and attachments are automatically scanned. This operates in addition to the SmartScreen filter, which scans files before and during downloading | Enabled +Real-time protection | Turn on process scanning whenever real-time protection is enabled | You can independently enable the antivirus engine to scan running processes for suspicious modifications or behaviors. This is useful if you have disabled real-time protection | Enabled Real-time protection | Turn on behavior monitoring | The AV engine will monitor file processes, file and registry changes, and other events on your endpoints for suspicious and known malicious activity | Enabled Real-time protection | Turn on raw volume write notifications | Information about raw volume writes will be analyzed by behavior monitoring | Enabled -Real-time protection | Define the maximum size of downloaded files and attachments to be scanned | You can define the size in kilobytes | Enabled -Real-time protection | Configure monitoring for incoming and outgoing file and program activity | Specify whether monitoring should occur on incoming, outgoing, both, or neither direction. This is relevant for Windows Server installations where you have defined specific servers or Server Roles that see large amounts of file changes in only one direction and you want to improve network performance. Note that fully updated endpoints (and servers) on a network will see little performance impact irrespective of the number or direction of file changes. | Enabled (both directions) -Scan | Turn on heuristics | Heuristic protection will disable or block suspicious activity immediately before the AV engine is asked to detect the activity | Enabled -Root | Allow antimalware service to startup with normal priority | You can lower the priority of the AV engine, which may be useful in lightweight deployments where you want to have as lean a startup process as possible. This may impact protection on the endpoint. | Enabled -Root | Allow antimalware service to remain running always | If protection updates have been disabled, you can set Windows Defender AV to still run. This lowers the protection on the endpoint. | Disabled - - - +Real-time protection | Define the maximum size of downloaded files and attachments to be scanned | You can define the size in kilobytes | Enabled +Real-time protection | Configure monitoring for incoming and outgoing file and program activity | Specify whether monitoring should occur on incoming, outgoing, both, or neither direction. This is relevant for Windows Server installations where you have defined specific servers or Server Roles that see large amounts of file changes in only one direction and you want to improve network performance. Note that fully updated endpoints (and servers) on a network will see little performance impact irrespective of the number or direction of file changes. | Enabled (both directions) +Scan | Turn on heuristics | Heuristic protection will disable or block suspicious activity immediately before the antivirus engine is asked to detect the activity | Enabled +Root | Allow antimalware service to startup with normal priority | You can lower the priority of the antivirus engine, which may be useful in lightweight deployments where you want to have as lean a startup process as possible. This may impact protection on the endpoint. | Enabled +Root | Allow antimalware service to remain running always | If protection updates have been disabled, you can set antivirus to still run. This lowers the protection on the endpoint. | Disabled ## Disable real-time protection > [!WARNING] @@ -83,17 +59,15 @@ The main real-time protection capability is enabled by default, but you can disa **Use Group Policy to disable real-time protection:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Real-time protection**. - -6. Double-click the **Turn off real-time protection** setting and set the option to **Enabled**. Click **OK**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +3. Expand the tree to **Windows components > Windows Defender Antivirus > Real-time protection**. +4. Double-click the **Turn off real-time protection** setting and set the option to **Enabled**. Click **OK**. ## Related topics - [Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) From c5ad334960d0fd4c59326cf454b471f73e3661d1 Mon Sep 17 00:00:00 2001 From: Andrea Bichsel <35236577+andreabichsel@users.noreply.github.com> Date: Thu, 9 Aug 2018 15:40:41 -0700 Subject: [PATCH 049/286] Content reorg and rebranding changes --- ...llect-diagnostic-data-update-compliance.md | 2 +- ...-remediation-windows-defender-antivirus.md | 51 ++- ...r-exclusions-windows-defender-antivirus.md | 320 +++++++++--------- ...ure-windows-defender-antivirus-features.md | 36 +- ...ediate-scans-windows-defender-antivirus.md | 30 +- ...anage-report-windows-defender-antivirus.md | 49 +-- .../deploy-windows-defender-antivirus.md | 33 +- ...ployment-vdi-windows-defender-antivirus.md | 215 ++++++------ ...nwanted-apps-windows-defender-antivirus.md | 58 ++-- ...d-protection-windows-defender-antivirus.md | 10 - .../evaluate-windows-defender-antivirus.md | 10 - ...dic-scanning-windows-defender-antivirus.md | 12 - ...ased-updates-windows-defender-antivirus.md | 7 - ...ed-endpoints-windows-defender-antivirus.md | 7 - ...ate-schedule-windows-defender-antivirus.md | 7 - ...tion-updates-windows-defender-antivirus.md | 7 - ...es-baselines-windows-defender-antivirus.md | 9 - ...-devices-vms-windows-defender-antivirus.md | 7 - ...-interaction-windows-defender-antivirus.md | 12 - ...port-monitor-windows-defender-antivirus.md | 8 - ...ntined-files-windows-defender-antivirus.md | 10 - ...scan-results-windows-defender-antivirus.md | 9 - .../run-scan-windows-defender-antivirus.md | 12 - ...tch-up-scans-windows-defender-antivirus.md | 8 - ...ection-level-windows-defender-antivirus.md | 10 - .../troubleshoot-reporting.md | 8 - ...troubleshoot-windows-defender-antivirus.md | 10 - ...group-policy-windows-defender-antivirus.md | 4 - ...hell-cmdlets-windows-defender-antivirus.md | 4 - .../use-wmi-windows-defender-antivirus.md | 4 - ...d-protection-windows-defender-antivirus.md | 8 - ...indows-defender-antivirus-compatibility.md | 12 - ...indows-defender-antivirus-in-windows-10.md | 4 - ...fender-antivirus-on-windows-server-2016.md | 12 - .../windows-defender-offline.md | 9 - ...dows-defender-security-center-antivirus.md | 8 - 36 files changed, 344 insertions(+), 678 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md b/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md index b4c0e6729e..fb35fa1f8f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md +++ b/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md @@ -1,6 +1,6 @@ --- title: Collect diagnostic data for Update Compliance and antivirus -description: Use a tool to collect data to troubleshoot Update Compliance issues when using the Windows Defender AV Assessment add in +description: Use a tool to collect data to troubleshoot Update Compliance issues when using the antivirus Assessment add in keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, windows defender av search.product: eADQiWindows 10XVcnh ms.pagetype: security diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md index c409e9402c..620eb0a22d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Remediate and resolve infections detected by Windows Defender AV -description: Configure what Windows Defender AV should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder +title: Remediate and resolve infections detected by antivirus +description: Configure what antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder keywords: remediation, fix, remove, threats, quarantine, scan, restore search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -14,16 +14,7 @@ ms.author: v-anbic ms.date: 07/10/2018 --- - - -# Configure remediation for Windows Defender AV scans - -**Applies to** -- Windows 10 - -**Audience** - -- Enterprise security administrators +# Configure remediation for antivirus scans **Manageability available with** @@ -33,7 +24,7 @@ ms.date: 07/10/2018 - Windows Management Instrumentation (WMI) - Microsoft Intune -When Windows Defender Antivirus runs a scan, it will attempt to remediate or remove threats that it finds. You can configure how Windows Defender AV should react to certain threats, whether it should create a restore point before remediating, and when it should remove remediated threats. +When antivirus runs a scan, it will attempt to remediate or remove threats that it finds. You can configure how antivirus should react to certain threats, whether it should create a restore point before remediating, and when it should remove remediated threats. This topic describes how to configure these settings with Group Policy, but you can also use [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#threat-overrides-settings) and [Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure). @@ -45,40 +36,38 @@ You can configure how remediation works with the Group Policy settings described To configure these settings: -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below. - -6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. +3. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below. +4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. Location | Setting | Description | Default setting (if not configured) ---|---|---|--- Scan | Create a system restore point | A system restore point will be created each day before cleaning or scanning is attempted | Disabled Scan | Turn on removal of items from scan history folder | Specify how many days items should be kept in the scan history | 30 days -Root | Turn off routine remediation | You can specify whether Windows Defender AV automatically remediates threats, or if it should ask the endpoint user what to do. | Disabled (threats are remediated automatically) +Root | Turn off routine remediation | You can specify whether antivirus automatically remediates threats, or if it should ask the endpoint user what to do. | Disabled (threats are remediated automatically) Quarantine | Configure removal of items from Quarantine folder | Specify how many days items should be kept in quarantine before being removed | Never removed -Threats | Specify threat alert levels at which default action should not be taken when detected | Every threat that is detected by Windows Defender AV is assigned a threat level (low, medium, high, or severe). You can use this setting to define how all threats for each of the threat levels should be remediated (quarantined, removed, or ignored) | Not applicable +Threats | Specify threat alert levels at which default action should not be taken when detected | Every threat that is detected by antivirus is assigned a threat level (low, medium, high, or severe). You can use this setting to define how all threats for each of the threat levels should be remediated (quarantined, removed, or ignored) | Not applicable Threats | Specify threats upon which default action should not be taken when detected | Specify how specific threats (using their threat ID) should be remediated. You can specify whether the specific threat should be quarantined, removed, or ignored | Not applicable >[!IMPORTANT] ->Windows Defender Antivirus detects and remediates files based on many factors. Sometimes, completing a remediation requires a reboot. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed. +>Antivirus detects and remediates files based on many factors. Sometimes, completing a remediation requires a reboot. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed. >

->If you are certain Windows Defender AV quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in Windows Defender AV](restore-quarantined-files-windows-defender-antivirus.md). +>If you are certain antivirus quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in antivirus](restore-quarantined-files-windows-defender-antivirus.md). >

->To avoid this problem in the future, you can exclude files from the scans. See [Configure and validate exclusions for Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md). +>To avoid this problem in the future, you can exclude files from the scans. See [Configure and validate exclusions for antivirus scans](configure-exclusions-windows-defender-antivirus.md). - -Also see the [Configure remediation-required scheduled full scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md#remed) topic for more remediation-related settings. +Also see [Configure remediation-required scheduled full antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md#remed) for more remediation-related settings. ## Related topics -- [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) -- [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) -- [Configure and run on-demand Windows Defender AV scans](run-scan-windows-defender-antivirus.md) +- [Configure antivirus scanning options](configure-advanced-scan-types-windows-defender-antivirus.md) +- [Configure scheduled antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md) +- [Configure and run on-demand antivirus scans](run-scan-windows-defender-antivirus.md) - [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) -- [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-windows-defender-antivirus.md) -- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file +- [Configure end-user antivirus interaction](configure-end-user-interaction-windows-defender-antivirus.md) +- [Customize, initiate, and review the results of antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md index 1b9179c6b3..bc1f8cec27 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md @@ -1,7 +1,7 @@ --- -title: Automatic and customized exclusions for Windows Defender AV on Windows Server 2016 -description: Windows Server 2016 includes automatic exclusions, based on Server Role. You can also add custom exclusions. -keywords: exclusions, server, auto-exclusions, automatic, custom, scans +title: Configure antivirus exclusions on Windows Server 2016 +description: Windows Server 2016 includes automatic exclusions, based on server role. You can also add custom exclusions. +keywords: exclusions, server, auto-exclusions, automatic, custom, scans, antivirus search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -14,17 +14,7 @@ ms.author: v-anbic ms.date: 05/17/2018 --- -# Configure exclusions in Windows Defender AV on Windows Server - - -**Applies to:** - -- Windows Server 2016 - -**Audience** - -- Enterprise security administrators - +# Configure antivirus exclusions on Windows Server **Manageability available with** @@ -32,25 +22,25 @@ ms.date: 05/17/2018 - PowerShell - Windows Management Instrumentation (WMI) -If you are using Windows Defender Antivirus to protect Windows Server 2016 machines, you are automatically enrolled in certain exclusions, as defined by your specified Windows Server Role. A list of these exclusions is provided at [the end of this topic](#list-of-automatic-exclusions). +Antivirus on Windows Server 2016 computers automatically enrolls you in certain exclusions, as defined by your specified server role. See [the end of this topic](#list-of-automatic-exclusions) for a list of these exclusions. These exclusions will not appear in the standard exclusion lists shown in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). -You can still add or remove custom exclusions (in addition to the Server Role-defined automatic exclusions) as described in the other exclusion-related topics: +You can still add or remove custom exclusions (in addition to the server role-defined automatic exclusions) as described in these exclusion-related topics: + - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) -Custom exclusions take precedence over the automatic exclusions. +Custom exclusions take precedence over automatic exclusions. > [!TIP] > Custom and duplicate exclusions do not conflict with automatic exclusions. -Windows Defender AV uses the Deployment Image Servicing and Management (DSIM) tools to determine which roles are installed on your computer. - +Antivirus uses the Deployment Image Servicing and Management (DISM) tools to determine which roles are installed on your computer. ## Opt out of automatic exclusions -In Windows Server 2016 the predefined exclusions delivered by definition updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, you need to opt-out of the automatic exclusions delivered in definition updates. +In Windows Server 2016, the predefined exclusions delivered by definition updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, you need to opt out of the automatic exclusions delivered in definition updates. > [!WARNING] > Opting out of automatic exclusions may adversely impact performance, or result in data corruption. The exclusions that are delivered automatically are optimized for Windows Server 2016 roles. @@ -58,17 +48,17 @@ In Windows Server 2016 the predefined exclusions delivered by definition updates > [!NOTE] > This setting is only supported on Windows Server 2016. While this setting exists in Windows 10, it doesn't have an effect on exclusions. -You can disable the auto-exclusions lists with Group Policy, PowerShell cmdlets, and WMI. +You can disable the automatic exclusion lists with Group Policy, PowerShell cmdlets, and WMI. **Use Group Policy to disable the auto-exclusions list on Windows Server 2016:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. +3. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. -6. Double-click the **Turn off Auto Exclusions** setting and set the option to **Enabled**. Click **OK**. +4. Double-click **Turn off Auto Exclusions** and set the option to **Enabled**. Click **OK**. **Use PowerShell cmdlets to disable the auto-exclusions list on Windows Server 2016:** @@ -91,311 +81,305 @@ DisableAutoExclusions See the following for more information and allowed parameters: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) - ## List of automatic exclusions The following sections contain the exclusions that are delivered with automatic exclusions file paths and file types. ### Default exclusions for all roles This section lists the default exclusions for all Windows Server 2016 roles. -- Windows "temp.edb" files: +- Windows "temp.edb" files: - - *%windir%*\SoftwareDistribution\Datastore\\*\tmp.edb + - *%windir%*\SoftwareDistribution\Datastore\\*\tmp.edb - - *%ProgramData%*\Microsoft\Search\Data\Applications\Windows\\*\\\*.log + - *%ProgramData%*\Microsoft\Search\Data\Applications\Windows\\*\\\*.log -- Windows Update files or Automatic Update files: +- Windows Update files or Automatic Update files: - - *%windir%*\SoftwareDistribution\Datastore\\*\Datastore.edb + - *%windir%*\SoftwareDistribution\Datastore\\*\Datastore.edb - - *%windir%*\SoftwareDistribution\Datastore\\*\edb.chk + - *%windir%*\SoftwareDistribution\Datastore\\*\edb.chk - - *%windir%*\SoftwareDistribution\Datastore\\*\edb\*.log + - *%windir%*\SoftwareDistribution\Datastore\\*\edb\*.log - - *%windir%*\SoftwareDistribution\Datastore\\*\Edb\*.jrs + - *%windir%*\SoftwareDistribution\Datastore\\*\Edb\*.jrs - - *%windir%*\SoftwareDistribution\Datastore\\*\Res\*.log + - *%windir%*\SoftwareDistribution\Datastore\\*\Res\*.log -- Windows Security files: +- Windows Security files: - - *%windir%*\Security\database\\*.chk + - *%windir%*\Security\database\\*.chk - - *%windir%*\Security\database\\*.edb + - *%windir%*\Security\database\\*.edb - - *%windir%*\Security\database\\*.jrs + - *%windir%*\Security\database\\*.jrs - - *%windir%*\Security\database\\*.log + - *%windir%*\Security\database\\*.log - - *%windir%*\Security\database\\*.sdb + - *%windir%*\Security\database\\*.sdb -- Group Policy files: +- Group Policy files: - - *%allusersprofile%*\NTUser.pol + - *%allusersprofile%*\NTUser.pol - - *%SystemRoot%*\System32\GroupPolicy\Machine\registry.pol + - *%SystemRoot%*\System32\GroupPolicy\Machine\registry.pol - - *%SystemRoot%*\System32\GroupPolicy\User\registry.pol + - *%SystemRoot%*\System32\GroupPolicy\User\registry.pol -- WINS files: +- WINS files: - - *%systemroot%*\System32\Wins\\*\\\*.chk + - *%systemroot%*\System32\Wins\\*\\\*.chk - - *%systemroot%*\System32\Wins\\*\\\*.log + - *%systemroot%*\System32\Wins\\*\\\*.log - - *%systemroot%*\System32\Wins\\*\\\*.mdb + - *%systemroot%*\System32\Wins\\*\\\*.mdb - - *%systemroot%*\System32\LogFiles\ + - *%systemroot%*\System32\LogFiles\ - - *%systemroot%*\SysWow64\LogFiles\ + - *%systemroot%*\SysWow64\LogFiles\ -- File Replication Service (FRS) exclusions: +- File Replication Service (FRS) exclusions: - - Files in the File Replication Service (FRS) working folder. The FRS working folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory` + - Files in the File Replication Service (FRS) working folder. The FRS working folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory` - - *%windir%*\Ntfrs\jet\sys\\*\edb.chk + - *%windir%*\Ntfrs\jet\sys\\*\edb.chk - - *%windir%*\Ntfrs\jet\\*\Ntfrs.jdb + - *%windir%*\Ntfrs\jet\\*\Ntfrs.jdb - - *%windir%*\Ntfrs\jet\log\\*\\\*.log + - *%windir%*\Ntfrs\jet\log\\*\\\*.log - - FRS Database log files. The FRS Database log file folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\Ntfrs\Parameters\DB Log File Directory` + - FRS Database log files. The FRS Database log file folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\Ntfrs\Parameters\DB Log File Directory` - - *%windir%*\Ntfrs\\*\Edb\*.log + -*%windir%*\Ntfrs\\*\Edb\*.log - - The FRS staging folder. The staging folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage` + - The FRS staging folder. The staging folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage` - - *%systemroot%*\Sysvol\\*\Nntfrs_cmp\*\ + - *%systemroot%*\Sysvol\\*\Nntfrs_cmp\*\ - - The FRS preinstall folder. This folder is specified by the folder `Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory` + - The FRS preinstall folder. This folder is specified by the folder `Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory` - - *%systemroot%*\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\\*\Ntfrs\*\ + - *%systemroot%*\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\\*\Ntfrs\*\ - - The Distributed File System Replication (DFSR) database and working folders. These folders are specified by the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\DFSR\Parameters\Replication Groups\GUID\Replica Set Configuration File` + - The Distributed File System Replication (DFSR) database and working folders. These folders are specified by the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\DFSR\Parameters\Replication Groups\GUID\Replica Set Configuration File` - - *%systemdrive%*\System Volume Information\DFSR\\$db_normal$ + - *%systemdrive%*\System Volume Information\DFSR\\$db_normal$ - - *%systemdrive%*\System Volume Information\DFSR\FileIDTable_* + - *%systemdrive%*\System Volume Information\DFSR\FileIDTable_* - - *%systemdrive%*\System Volume Information\DFSR\SimilarityTable_* + - *%systemdrive%*\System Volume Information\DFSR\SimilarityTable_* - - *%systemdrive%*\System Volume Information\DFSR\\*.XML + - *%systemdrive%*\System Volume Information\DFSR\\*.XML - - *%systemdrive%*\System Volume Information\DFSR\\$db_dirty$ + - *%systemdrive%*\System Volume Information\DFSR\\$db_dirty$ - - *%systemdrive%*\System Volume Information\DFSR\\$db_clean$ + - *%systemdrive%*\System Volume Information\DFSR\\$db_clean$ - - *%systemdrive%*\System Volume Information\DFSR\\$db_lostl$ + - *%systemdrive%*\System Volume Information\DFSR\\$db_lostl$ - - *%systemdrive%*\System Volume Information\DFSR\Dfsr.db + - *%systemdrive%*\System Volume Information\DFSR\Dfsr.db - - *%systemdrive%*\System Volume Information\DFSR\\*.frx + - *%systemdrive%*\System Volume Information\DFSR\\*.frx - - *%systemdrive%*\System Volume Information\DFSR\\*.log + - *%systemdrive%*\System Volume Information\DFSR\\*.log - - *%systemdrive%*\System Volume Information\DFSR\Fsr*.jrs + - *%systemdrive%*\System Volume Information\DFSR\Fsr*.jrs - - *%systemdrive%*\System Volume Information\DFSR\Tmp.edb + - *%systemdrive%*\System Volume Information\DFSR\Tmp.edb -- Process exclusions +- Process exclusions - - *%systemroot%*\System32\dfsr.exe + - *%systemroot%*\System32\dfsr.exe - - *%systemroot%*\System32\dfsrs.exe + - *%systemroot%*\System32\dfsrs.exe -- Hyper-V exclusions: +- Hyper-V exclusions: - - This section lists the file type exclusions, folder exclusions, and process exclusions that are delivered automatically when you install the Hyper-V role + - This section lists the file type exclusions, folder exclusions, and process exclusions that are delivered automatically when you install the Hyper-V role - - File type exclusions: + - File type exclusions: - - *.vhd + - *.vhd - - *.vhdx + - *.vhdx - - *.avhd + - *.avhd - - *.avhdx + - *.avhdx - - *.vsv + - *.vsv - - *.iso + - *.iso - - *.rct + - *.rct - - *.vmcx + - *.vmcx - - *.vmrs + - *.vmrs - - Folder exclusions: + - Folder exclusions: - - *%ProgramData%*\Microsoft\Windows\Hyper-V + - *%ProgramData%*\Microsoft\Windows\Hyper-V - - *%ProgramFiles%*\Hyper-V + - *%ProgramFiles%*\Hyper-V - - *%SystemDrive%*\ProgramData\Microsoft\Windows\Hyper-V\Snapshots + - *%SystemDrive%*\ProgramData\Microsoft\Windows\Hyper-V\Snapshots - - *%Public%*\Documents\Hyper-V\Virtual Hard Disks + - *%Public%*\Documents\Hyper-V\Virtual Hard Disks - - Process exclusions: + - Process exclusions: - - *%systemroot%*\System32\Vmms.exe + - *%systemroot%*\System32\Vmms.exe - - *%systemroot%*\System32\Vmwp.exe + - *%systemroot%*\System32\Vmwp.exe -- SYSVOL files: +- SYSVOL files: - - *%systemroot%*\Sysvol\Domain\\*.adm + - *%systemroot%*\Sysvol\Domain\\*.adm - - *%systemroot%*\Sysvol\Domain\\*.admx + - *%systemroot%*\Sysvol\Domain\\*.admx - - *%systemroot%*\Sysvol\Domain\\*.adml + - *%systemroot%*\Sysvol\Domain\\*.adml - - *%systemroot%*\Sysvol\Domain\Registry.pol + - *%systemroot%*\Sysvol\Domain\Registry.pol - - *%systemroot%*\Sysvol\Domain\\*.aas + - *%systemroot%*\Sysvol\Domain\\*.aas - - *%systemroot%*\Sysvol\Domain\\*.inf + - *%systemroot%*\Sysvol\Domain\\*.inf - - *%systemroot%*\Sysvol\Domain\\*.Scripts.ini + - *%systemroot%*\Sysvol\Domain\\*.Scripts.ini - - *%systemroot%*\Sysvol\Domain\\*.ins + - *%systemroot%*\Sysvol\Domain\\*.ins - - *%systemroot%*\Sysvol\Domain\Oscfilter.ini + - *%systemroot%*\Sysvol\Domain\Oscfilter.ini ### Active Directory exclusions This section lists the exclusions that are delivered automatically when you install Active Directory Domain Services. -- NTDS database files. The database files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File` +- NTDS database files. The database files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File` - - %windir%\Ntds\ntds.dit + - %windir%\Ntds\ntds.dit - - %windir%\Ntds\ntds.pat + - %windir%\Ntds\ntds.pat -- The AD DS transaction log files. The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files` +- The AD DS transaction log files. The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files` - - %windir%\Ntds\EDB*.log + - %windir%\Ntds\EDB*.log - - %windir%\Ntds\Res*.log + - %windir%\Ntds\Res*.log - - %windir%\Ntds\Edb*.jrs + - %windir%\Ntds\Edb*.jrs - - %windir%\Ntds\Ntds*.pat + - %windir%\Ntds\Ntds*.pat - - %windir%\Ntds\EDB*.log + - %windir%\Ntds\EDB*.log - - %windir%\Ntds\TEMP.edb + - %windir%\Ntds\TEMP.edb -- The NTDS working folder. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory` +- The NTDS working folder. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory` - - %windir%\Ntds\Temp.edb + - %windir%\Ntds\Temp.edb - - %windir%\Ntds\Edb.chk + - %windir%\Ntds\Edb.chk -- Process exclusions for AD DS and AD DS-related support files: +- Process exclusions for AD DS and AD DS-related support files: - - %systemroot%\System32\ntfrs.exe + - %systemroot%\System32\ntfrs.exe - - %systemroot%\System32\lsass.exe + - %systemroot%\System32\lsass.exe ### DHCP Server exclusions This section lists the exclusions that are delivered automatically when you install the DHCP Server role. The DHCP Server file locations are specified by the *DatabasePath*, *DhcpLogFilePath*, and *BackupDatabasePath* parameters in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\Parameters` -- *%systemroot%*\System32\DHCP\\*\\\*.mdb +- *%systemroot%*\System32\DHCP\\*\\\*.mdb -- *%systemroot%*\System32\DHCP\\*\\\*.pat +- *%systemroot%*\System32\DHCP\\*\\\*.pat -- *%systemroot%*\System32\DHCP\\*\\\*.log +- *%systemroot%*\System32\DHCP\\*\\\*.log -- *%systemroot%*\System32\DHCP\\*\\\*.chk +- *%systemroot%*\System32\DHCP\\*\\\*.chk -- *%systemroot%*\System32\DHCP\\*\\\*.edb +- *%systemroot%*\System32\DHCP\\*\\\*.edb ### DNS Server exclusions This section lists the file and folder exclusions and the process exclusions that are delivered automatically when you install the DNS Server role. -- File and folder exclusions for the DNS Server role: +- File and folder exclusions for the DNS Server role: - - *%systemroot%*\System32\Dns\\*\\\*.log + - *%systemroot%*\System32\Dns\\*\\\*.log - - *%systemroot%*\System32\Dns\\*\\\*.dns + - *%systemroot%*\System32\Dns\\*\\\*.dns - - *%systemroot%*\System32\Dns\\*\\\*.scc + - *%systemroot%*\System32\Dns\\*\\\*.scc - - *%systemroot%*\System32\Dns\\*\BOOT + - *%systemroot%*\System32\Dns\\*\BOOT -- Process exclusions for the DNS Server role: +- Process exclusions for the DNS Server role: - - *%systemroot%*\System32\dns.exe - - + - *%systemroot%*\System32\dns.exe ### File and Storage Services exclusions This section lists the file and folder exclusions that are delivered automatically when you install the File and Storage Services role. The exclusions listed below do not include exclusions for the Clustering role. -- *%SystemDrive%*\ClusterStorage +- *%SystemDrive%*\ClusterStorage -- *%clusterserviceaccount%*\Local Settings\Temp +- *%clusterserviceaccount%*\Local Settings\Temp -- *%SystemDrive%*\mscs +- *%SystemDrive%*\mscs ### Print Server exclusions This section lists the file type exclusions, folder exclusions, and the process exclusions that are delivered automatically when you install the Print Server role. -- File type exclusions: +- File type exclusions: - - *.shd + - *.shd - - *.spl + - *.spl -- Folder exclusions. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory` +- Folder exclusions. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory` - - *%system32%*\spool\printers\\* + - *%system32%*\spool\printers\\* -- Process exclusions: +- Process exclusions: - - spoolsv.exe + - spoolsv.exe ### Web Server exclusions This section lists the folder exclusions and the process exclusions that are delivered automatically when you install the Web Server role. -- Folder exclusions: +- Folder exclusions: - - *%SystemRoot%*\IIS Temporary Compressed Files + - *%SystemRoot%*\IIS Temporary Compressed Files - - *%SystemDrive%*\inetpub\temp\IIS Temporary Compressed Files + - *%SystemDrive%*\inetpub\temp\IIS Temporary Compressed Files - - *%SystemDrive%*\inetpub\temp\ASP Compiled Templates + - *%SystemDrive%*\inetpub\temp\ASP Compiled Templates - - *%systemDrive%*\inetpub\logs + - *%systemDrive%*\inetpub\logs - - *%systemDrive%*\inetpub\wwwroot + - *%systemDrive%*\inetpub\wwwroot -- Process exclusions: +- Process exclusions: - - *%SystemRoot%*\system32\inetsrv\w3wp.exe + - *%SystemRoot%*\system32\inetsrv\w3wp.exe - - *%SystemRoot%*\SysWOW64\inetsrv\w3wp.exe + - *%SystemRoot%*\SysWOW64\inetsrv\w3wp.exe - - *%SystemDrive%*\PHP5433\php-cgi.exe + - *%SystemDrive%*\PHP5433\php-cgi.exe ### Windows Server Update Services exclusions This section lists the folder exclusions that are delivered automatically when you install the Windows Server Update Services (WSUS) role. The WSUS folder is specified in the registry key `HKEY_LOCAL_MACHINE\Software\Microsoft\Update Services\Server\Setup` -- *%systemroot%*\WSUS\WSUSContent - -- *%systemroot%*\WSUS\UpdateServicesDBFiles - -- *%systemroot%*\SoftwareDistribution\Datastore - -- *%systemroot%*\SoftwareDistribution\Download +- *%systemroot%*\WSUS\WSUSContent +- *%systemroot%*\WSUS\UpdateServicesDBFiles +- *%systemroot%*\SoftwareDistribution\Datastore +- *%systemroot%*\SoftwareDistribution\Download ## Related topics -- [Configure and validate exclusions for Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) +- [Configure and validate exclusions for antivirus scans](configure-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) -- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file +- [Customize, initiate, and review the results of antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md b/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md index ecc4190de1..a6a49ed48c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md @@ -1,7 +1,7 @@ --- -title: Configure Windows Defender Antivirus features (Windows 10) -description: You can configure features for Windows Defender Antivirus using Configuration Manager, MDM software (such as Intune), PowerShell, and with Group Policy settings. -keywords: windows defender antivirus, antimalware, security, defender, configure, configuration, Config Manager, System Center Configuration Manager, SCCM, Intune, MDM, mobile device management, GP, group policy, PowerShell +title: Configure antivirus features +description: You can configure antivirus features with Intune, System Center Configuration Manager, Group Policy, and PowerShell. +keywords: antivirus, antimalware, security, defender, configure, configuration, Config Manager, System Center Configuration Manager, SCCM, Intune, MDM, mobile device management, GP, group policy, PowerShell search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -14,25 +14,15 @@ ms.author: v-anbic ms.date: 08/26/2017 --- -# Configure Windows Defender Antivirus features +# Configure antivirus features +You can configure antivirus with a number of tools, including: -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators - -Windows Defender Antivirus can be configured with a number of tools, including: - -- Group Policy settings +- Microsoft Intune - System Center Configuration Manager +- Group Policy - PowerShell cmdlets - Windows Management Instrumentation (WMI) -- Microsoft Intune - The following broad categories of features can be configured: @@ -40,17 +30,13 @@ The following broad categories of features can be configured: - Always-on real-time protection, including behavioral, heuristic, and machine-learning-based protection - How end-users interact with the client on individual endpoints -The topics in this section describe how to perform key tasks when configuring Windows Defender AV. Each topic includes instructions for the applicable configuration tool (or tools). +The topics in this section describe how to perform key tasks when configuring antivirus. Each topic includes instructions for the applicable configuration tool (or tools). You can also review the [Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md) topic for an overview of each tool and links to further help. - ## In this section Topic | Description :---|:--- -[Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) | Cloud-delivered protection provides an advanced level of fast, robust antivirus detection -[Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md)|Enable behavior-based, heuristic, and real-time protection in Windows Defender AV -[Configure end-user interaction with Windows Defender Antivirus](configure-end-user-interaction-windows-defender-antivirus.md)|Configure how end-users interact with Windows Defender AV, what notifications they see, and if they can override settings - - - +[Utilize Microsoft cloud-provided antivirus protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) | Cloud-delivered protection provides an advanced level of fast, robust antivirus detection +[Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md)|Enable behavior-based, heuristic, and real-time antivirus protection +[Configure end-user antivirus interaction](configure-end-user-interaction-windows-defender-antivirus.md)|Configure how end-users interact with antivirus, what notifications they see, and whether they can override settings diff --git a/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md index 5c57af4d4c..d289ad74ed 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md @@ -1,7 +1,7 @@ --- title: Run and customize scheduled and on-demand scans -description: Customize and initiate scans using Windows Defender AV on endpoints across your network. -keywords: scan, schedule, customize, exclusions, exclude files, remediation, scan results, quarantine, remove threat, quick scan, full scan +description: Customize and initiate antivirus scans on endpoints across your network. +keywords: scan, schedule, customize, exclusions, exclude files, remediation, scan results, quarantine, remove threat, quick scan, full scan, antivirus search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -14,29 +14,17 @@ ms.author: v-anbic ms.date: 08/26/2017 --- -# Customize, initiate, and review the results of Windows Defender AV scans and remediation - -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators - - -You can use Group Policy, PowerShell, and Windows Management Instrumentation (WMI) to configure scans run by Windows Defender Antivirus. - +# Customize, initiate, and review the results of antivirus scans and remediation +You can use Group Policy, PowerShell, and Windows Management Instrumentation (WMI) to configure antivirus scans. ## In this section -Topic | Description +Topic | Description ---|--- -[Configure and validate file, folder, and process-opened file exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) | You can exclude files (including files modified by specified processes) and folders from on-demand scans, scheduled scans, and always-on real-time protection monitoring and scanning -[Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) | You can configure Windows Defender AV to include certain types of email storage files, back-up or reparse points, and archived files (such as .zip files) in scans. You can also enable network file scanning -[Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) | Configure what Windows Defender AV should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder +[Configure and validate file, folder, and process-opened file exclusions in antivirus scans](configure-exclusions-windows-defender-antivirus.md) | You can exclude files (including files modified by specified processes) and folders from on-demand scans, scheduled scans, and always-on real-time protection monitoring and scanning +[Configure antivirus scanning options](configure-advanced-scan-types-windows-defender-antivirus.md) | You can configure antivirus to include certain types of email storage files, back-up or reparse points, and archived files (such as .zip files) in scans. You can also enable network file scanning +[Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) | Configure what antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) | Set up recurring (scheduled) scans, including when they should run and whether they run as full or quick scans -[Configure and run scans](run-scan-windows-defender-antivirus.md) | Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Defender Security Center app +[Configure and run scans](run-scan-windows-defender-antivirus.md) | Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Defender Security Center app [Review scan results](review-scan-results-windows-defender-antivirus.md) | Review the results of scans using System Center Configuration Manager, Microsoft Intune, or the Windows Defender Security Center app - diff --git a/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md index 12275ec64d..072c396133 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Deploy, manage, and report on Windows Defender Antivirus -description: You can deploy and manage Windows Defender Antivirus with Group Policy, Configuration Manager, WMI, PowerShell, or Intune +title: Deploy, manage, and report on antivirus +description: You can deploy and manage antivirus with Intune, System Center Configuration Manager, Group Policy, PowerShell, or WMI keywords: deploy, manage, update, protection, windows defender antivirus search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -14,46 +14,36 @@ ms.author: v-anbic ms.date: 07/19/2018 --- -# Deploy, manage, and report on Windows Defender Antivirus +# Deploy, manage, and report on antivirus -**Applies to:** +You can deploy, manage, and report on antivirus in a number of ways. -- Windows 10 +Because the antivirus client is installed as a core part of Windows 10, traditional deployment of a client to your endpoints does not apply. -**Audience** - -- IT administrators - -You can deploy, manage, and report on Windows Defender Antivirus in a number of ways. - -As the Windows Defender AV client is installed as a core part of Windows 10, traditional deployment of a client to your endpoints does not apply. - -However, in most cases you will still need to enable the protection service on your endpoints with System Center Configuration Manager, Microsoft Intune, Azure Security Center, or Group Policy Objects, which is described in the following table. +However, in most cases you will still need to enable the protection service on your endpoints with Microsoft Intune, System Center Configuration Manager, Azure Security Center, or Group Policy Objects, which is described in the following table. You'll also see additional links for: -- Managing Windows Defender Antivirus protection, including managing product and protection updates -- Reporting on Windows Defender Antivirus protection + +- Managing antivirus protection, including managing product and protection updates +- Reporting on antivirus protection > [!IMPORTANT] -> In most cases, Windows 10 will disable Windows Defender Antivirus if it finds another antivirus product running and up-to-date. You must disable or uninstall third-party antivirus products before Windows Defender Antivirus will be functioning. If you re-enable or install third-party antivirus products, then Windows 10 will automatically disable Windows Defender Antivirus. - +> In most cases, Windows 10 will disable antivirus if it finds another antivirus product that is running and up-to-date. You must disable or uninstall third-party antivirus products before antivirus will function. If you re-enable or install third-party antivirus products, then Windows 10 automatically disables antivirus. Tool|Deployment options (2)|Management options (network-wide configuration and policy or baseline deployment) ([3](#fn3))|Reporting options ---|---|---|--- -System Center Configuration Manager ([1](#fn1))|Use the [Endpoint Protection point site system role][] and [enable Endpoint Protection with custom client settings][]|With [default and customized antimalware policies][] and [client management][]|With the default [Configuration Manager Monitoring workspace][] and [email alerts][] Microsoft Intune|[Add endpoint protection settings in Intune](https://docs.microsoft.com/en-us/intune/endpoint-protection-configure)|[Configure device restriction settings in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure)| [Use the Intune console to manage devices](https://docs.microsoft.com/en-us/intune/device-management) -Windows Management Instrumentation|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set method of the MSFT_MpPreference class][] and the [Update method of the MSFT_MpSignature class][]|Use the [MSFT_MpComputerStatus][] class and the get method of associated classes in the [Windows Defender WMIv2 Provider][] -PowerShell|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference][] and [Update-MpSignature] [] cmdlets available in the Defender module|Use the appropriate [Get- cmdlets available in the Defender module][] +System Center Configuration Manager ([1](#fn1))|Use the [Endpoint Protection point site system role][] and [enable Endpoint Protection with custom client settings][]|With [default and customized antimalware policies][] and [client management][]|With the default [Configuration Manager Monitoring workspace][] and [email alerts][] Group Policy and Active Directory (domain-joined)|Use a Group Policy Object to deploy configuration changes and ensure Windows Defender Antivirus is enabled.|Use Group Policy Objects (GPOs) to [Configure update options for Windows Defender Antivirus][] and [Configure Windows Defender features][]|Endpoint reporting is not available with Group Policy. You can generate a list of [Group Policies to determine if any settings or policies are not applied][] +PowerShell|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference][] and [Update-MpSignature] [] cmdlets available in the Defender module|Use the appropriate [Get- cmdlets available in the Defender module][] +Windows Management Instrumentation|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set method of the MSFT_MpPreference class][] and the [Update method of the MSFT_MpSignature class][]|Use the [MSFT_MpComputerStatus][] class and the get method of associated classes in the [Windows Defender WMIv2 Provider][] Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by using Visual Studio virtual machine configuration, or using Azure PowerShell cmdlets](https://docs.microsoft.com/en-us/azure/security/azure-security-antimalware#antimalware-deployment-scenarios). You can also [Install Endpoint protection in Azure Security Center](https://docs.microsoft.com/en-us/azure/security-center/security-center-install-endpoint-protection)|Configure [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/en-us/powershell/servicemanagement/azure.antimalware/v3.4.0/azure.antimalware) or [use code samples](https://gallery.technet.microsoft.com/Antimalware-For-Azure-5ce70efe)|Use [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/en-us/powershell/servicemanagement/azure.antimalware/v3.4.0/azure.antimalware) to enable monitoring. You can also review usage reports in Azure Active Directory to determine suspicious activity, including the [Possibly infected devices][] report and configure an SIEM tool to report on [Windows Defender Antivirus events][] and add that tool as an app in AAD. 1. The availability of some functions and features, especially related to cloud-delivered protection, differ between System Center Configuration Manager (Current Branch) and System Center Configuration Manager 2012. In this library, we've focused on Windows 10, Windows Server 2016, and System Center Configuration Manager (Current Branch). See [Use Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for a table that describes the major differences. [(Return to table)](#ref2) 2. In Windows 10, Windows Defender Antivirus is a component available without installation or deployment of an additional client or service. It will automatically be enabled when third-party antivirus products are either uninstalled or out of date ([except on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md)). Traditional deployment therefore is not required. Deployment here refers to ensuring the Windows Defender Antivirus component is available and enabled on endpoints or servers. [(Return to table)](#ref2) -3. Configuration of features and protection, including configuring product and protection updates, are further described in the [Configure Windows Defender Antivirus features](configure-notifications-windows-defender-antivirus.md) section in this library. [(Return to table)](#ref2) - - +3. Configuration of features and protection, including configuring product and protection updates, are further described in the [Configure antivirus features](configure-notifications-windows-defender-antivirus.md) section in this library. [(Return to table)](#ref2) [Endpoint Protection point site system role]: https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-protection-site-role [default and customized antimalware policies]: https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies @@ -79,13 +69,10 @@ Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by [Possibly infected devices]: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-sign-ins-from-possibly-infected-devices [Windows Defender Antivirus events]: troubleshoot-windows-defender-antivirus.md - ## In this section -Topic | Description +Topic | Description ---|--- -[Deploy and enable Windows Defender Antivirus protection](deploy-windows-defender-antivirus.md) | While the client is installed as a core part of Windows 10, and traditional deployment does not apply, you will still need to enable the client on your endpoints with System Center Configuration Manager, Microsoft Intune, or Group Policy Objects. -[Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) | There are two parts to updating Windows Defender Antivirus: updating the client on endpoints (product updates), and updating definitions (protection updates). You can update definitions in a number of ways, using System Center Configuration Manager, Group Policy, PowerShell, and WMI. -[Monitor and report on Windows Defender Antivirus protection](report-monitor-windows-defender-antivirus.md) | You can use System Center Configuration Manager, the Update Compliance add-in for Microsoft Operations Management Suite, a third-party SIEM product (by consuming Windows event logs), or Microsoft Intune to monitor protection status and create reports about endpoint protection - - +[Deploy and enable antivirus protection](deploy-windows-defender-antivirus.md) | While the client is installed as a core part of Windows 10, and traditional deployment does not apply, you will still need to enable the client on your endpoints with System Center Configuration Manager, Microsoft Intune, or Group Policy Objects. +[Manage antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) | There are two parts to updating antivirus: updating the client on endpoints (product updates), and updating definitions (protection updates). You can update definitions in a number of ways, using System Center Configuration Manager, Group Policy, PowerShell, and WMI. +[Monitor and report on antivirus protection](report-monitor-windows-defender-antivirus.md) | You can use Microsoft Intune, System Center Configuration Manager, the Update Compliance add-in for Microsoft Operations Management Suite, or a third-party SIEM product (by consuming Windows event logs) to monitor protection status and create reports about endpoint protection. diff --git a/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md index dbd8572db4..813350355f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md @@ -1,7 +1,7 @@ --- -title: Deploy and enable Windows Defender Antivirus -description: Deploy Windows Defender AV for protection of your endpoints with Configuration Manager, Microsoft Intune, Group Policy, PowerShell cmdlets, or WMI. -keywords: deploy, enable, windows defender av +title: Deploy and enable antivirus +description: Deploy antivirus for protection of your endpoints with Microsoft Intune, System Center Configuration Manager, Group Policy, PowerShell cmdlets, or WMI. +keywords: deploy, enable, antivirus search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -14,29 +14,18 @@ ms.author: v-anbic ms.date: 04/30/2018 --- -# Deploy and enable Windows Defender Antivirus +# Deploy and enable antivirus +Depending on the management tool you are using, you may need to specifically enable or configure antivirus protection. -**Applies to:** +See the table in [Deploy, manage, and report on antivirus](deploy-manage-report-windows-defender-antivirus.md#ref2) for instructions on how to enable protection with Microsoft Intune, System Center Configuration Manager, Group Policy, Active Directory, Microsoft Azure, PowerShell cmdlets, and Windows Management Instruction (WMI). -- Windows 10 +Some scenarios require additional guidance on how to successfully deploy or configure antivirus protection, such as Virtual Desktop Infrastructure (VDI) environments. -**Audience** - -- Network administrators -- IT administrators - - -Depending on the management tool you are using, you may need to specifically enable or configure Windows Defender AV protection. - -See the table in the [Deploy, manage, and report on Windows Defender AV](deploy-manage-report-windows-defender-antivirus.md#ref2) topic for instructions on how to enable protection with System Center Configuration Manager, Group Policy, Active Directory, Microsoft Azure, Microsoft Intune, PowerShell cmdlets, and Windows Management Instruction (WMI). - -Some scenarios require additional guidance on how to successfully deploy or configure Windows Defender AV protection, such as Virtual Desktop Infrastructure (VDI) environments. - -The remaining topic in this section provides end-to-end advice and best practices for [setting up Windows Defender AV on virtual machines (VMs) in a VDI or Remote Desktop Services (RDS) environment](deployment-vdi-windows-defender-antivirus.md). +The remaining topic in this section provides end-to-end advice and best practices for [setting up antivirus on virtual machines (VMs) in a VDI or Remote Desktop Services (RDS) environment](deployment-vdi-windows-defender-antivirus.md). ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) -- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) -- [Deployment guide for Windows Defender Antivirus in a virtual desktop infrastructure (VDI) environment](deployment-vdi-windows-defender-antivirus.md) \ No newline at end of file +- [Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Deploy, manage updates, and report on antivirus](deploy-manage-report-windows-defender-antivirus.md) +- [Deployment guide for antivirus in a virtual desktop infrastructure (VDI) environment](deployment-vdi-windows-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md index 41343abb5c..3c507c86a9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md @@ -16,26 +16,16 @@ ms.date: 04/30/2018 # Deployment guide for Windows Defender Antivirus in a virtual desktop infrastructure (VDI) environment -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators - **Manageability available with** - System Center Configuration Manager (current branch) - Group Policy +In addition to standard on-premises or hardware configurations, you can also use antivirus in a remote desktop (RDS) or virtual desktop infrastructure (VDI) environment. +Boot storms can be a problem in large-scale VDIs; this guide will help reduce the overall network bandwidth and performance impact on your hardware. -In addition to standard on-premises or hardware configurations, you can also use Windows Defender Antivirus (Windows Defender AV) in a remote desktop (RDS) or virtual desktop infrastructure (VDI) environment. - -Boot storms can be a problem in large-scale VDIs; this guide will help reduce the overall network bandwidth and performance impact on your hardware. - -We recommend setting the following when deploying Windows Defender AV in a VDI environment: +We recommend setting the following when deploying antivirus in a VDI environment: Location | Setting | Suggested configuration ---|---|--- @@ -46,17 +36,20 @@ Root | Randomize scheduled task times | Enabled Signature updates | Turn on scan after signature update | Enabled Scan | Turn on catch up quick scan | Enabled -For more details on the best configuration options to ensure a good balance between performance and protection, including detailed instructions for Group Policy and System Center Configuration Manager, see the [Configure endpoints for optimal performance](#configure-endpoints-for-optimal-performance) section. +For more details on the best configuration options to ensure a good balance between performance and protection, including detailed instructions for System Center Configuration Manager and Group Policy, see the [Configure endpoints for optimal performance](#configure-endpoints-for-optimal-performance) section. See the [Microsoft Desktop virtualization site](https://www.microsoft.com/en-us/server-cloud/products/virtual-desktop-infrastructure/) for more details on Microsoft Remote Desktop Services and VDI support. For Azure-based virtual machines, you can also review the [Install Endpoint Protection in Azure Security Center](https://docs.microsoft.com/en-us/azure/security-center/security-center-install-endpoint-protection) topic. -There are three main steps in this guide to help roll out Windows Defender AV protection across your VDI: +There are three main steps in this guide to help roll out antivirus protection across your VDI: + +1. [Create and deploy the base image (for example, as a virtual hard disk (VHD)) that your virtual machines (VMs) will use](#create-and-deploy-the-base-image) + +2. [Manage the base image and updates for your VMs](#manage-your-vms-and-base-image) + +3. [Configure the VMs for optimal protection and performance](#configure-endpoints-for-optimal-performance), including: -1. [Create and deploy the base image (for example, as a virtual hard disk (VHD)) that your virtual machines (VMs) will use](#create-and-deploy-the-base-image) -2. [Manage the base image and updates for your VMs](#manage-your-vms-and-base-image) -3. [Configure the VMs for optimal protection and performance](#configure-endpoints-for-optimal-performance), including: - [Randomize scheduled scans](#randomize-scheduled-scans) - [Use quick scans](#use-quick-scans) - [Prevent notifications](#prevent-notifications) @@ -66,47 +59,49 @@ There are three main steps in this guide to help roll out Windows Defender AV pr >[!IMPORTANT] > While the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows. ->[!NOTE] ->When you manage Windows with System Center Configuration Manager, Windows Defender AV protection will be referred to as Endpoint Protection or System Center Endpoint Protection. See the [Endpoint Protection section at the Configuration Manager library]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-protection) for more information. +>[!NOTE] +>When you manage Windows with System Center Configuration Manager, antivirus protection will be referred to as Endpoint Protection or System Center Endpoint Protection. See the [Endpoint Protection section at the Configuration Manager library]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-protection) for more information. - - -## Create and deploy the base image +## Create and deploy the base image The main steps in this section include: -1. Create your standard base image according to your requirements -2. Apply Windows Defender AV protection updates to your base image -3. Seal or “lock†the image to create a “known-good†image -4. Deploy your image to your VMs + +1. Create your standard base image according to your requirements +2. Apply Windows Defender AV protection updates to your base image +3. Seal or “lock†the image to create a “known-good†image +4. Deploy your image to your VMs ### Create the base image + First, you should create your base image according to your business needs, applying or installing the relevant line of business (LOB) apps and settings as you normally would. Typically, this would involve creating a VHD or customized .iso, depending on how you will deploy the image to your VMs. ### Apply protection updates to the base image -After creating the image, you should ensure it is fully updated. See [Configure Windows Defender in Windows 10]( https://technet.microsoft.com/en-us/itpro/windows/keep-secure/configure-windows-defender-in-windows-10) for instructions on how to update Windows Defender AV protection via WSUS, Microsoft Update, the MMPC site, or UNC file shares. You should ensure that your initial base image is also fully patched with Microsoft and Windows updates and patches. + +After creating the image, you should ensure it is fully updated. See [Configure Windows Defender in Windows 10]( https://technet.microsoft.com/en-us/itpro/windows/keep-secure/configure-windows-defender-in-windows-10) for instructions on how to update antivirus protection via WSUS, Microsoft Update, the MMPC site, or UNC file shares. You should ensure that your initial base image is also fully patched with Microsoft and Windows updates and patches. ### Seal the base image -When the base image is fully updated, you should run a quick scan on the image. -After running a scan and buliding the cache, remove the machine GUID that uniquely identifies the device in telemetry for both Windows Defender Antivirus and the Microsoft Security Removal Tool. This key is located here: +When the base image is fully updated, you should run a quick scan on the image. + +After running a scan and buliding the cache, remove the machine GUID that uniquely identifies the device in telemetry for both antivirus and the Microsoft Security Removal Tool. This key is located here: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\MRT' Remove the string found in the 'GUID' value -This “sealing†or “locking†of the image helps Windows Defender AV build a cache of known-good files and avoid scanning them again on your VMs. In turn, this can help ensure performance on the VM is not impacted. +This “sealing†or “locking†of the image helps antivirus build a cache of known-good files and avoid scanning them again on your VMs. In turn, this can help ensure performance on the VM is not impacted. You can run a quick scan [from the command line](command-line-arguments-windows-defender-antivirus.md) or via [System Center Configuration Manager](run-scan-windows-defender-antivirus.md). ->[!NOTE] +>[!NOTE] >Quick scan versus full scan >Quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders. Combined with our always on real-time protection capability - which reviews files when they are opened and closed, and whenever a user navigates to a folder – quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware. ->Therefore, when considering performance – especially for creating a new or updated image in preparation for deployment – it makes sense to use a quick scan only. +>Therefore, when considering performance – especially for creating a new or updated image in preparation for deployment – it makes sense to use a quick scan only. >A full scan, however, can be useful on a VM that has encountered a malware threat to identify if there are any inactive components lying around and help perform a thorough clean-up. +### Deploy the base image -### Deploy the base image -You'll then need to deploy the base image across your VDI. For example, you can create or clone a VHD from your base image, and then use that VHD when you create or start your VMs. +You'll then need to deploy the base image across your VDI. For example, you can create or clone a VHD from your base image, and then use that VHD when you create or start your VMs. The following references provide ways you can create and deploy the base image across your VDI: @@ -116,58 +111,57 @@ The following references provide ways you can create and deploy the base image a - [Create a virtual machine in Hyper-V (with a VHD)](https://technet.microsoft.com/en-us/windows-server-docs/compute/hyper-v/get-started/create-a-virtual-machine-in-hyper-v) - [Build Virtual Desktop templates]( https://technet.microsoft.com/en-us/library/dn645526(v=ws.11).aspx) - - - - ## Manage your VMs and base image + How you manage your VDI will affect the performance impact of Windows Defender AV on your VMs and infrastructure. -Because Windows Defender AV downloads protection updates every day, or [based on your protection update settings](manage-protection-updates-windows-defender-antivirus.md), network bandwidth can be a problem if multiple VMs attempt to download updates at the same time. +Because antivirus downloads protection updates every day, or [based on your protection update settings](manage-protection-updates-windows-defender-antivirus.md), network bandwidth can be a problem if multiple VMs attempt to download updates at the same time. Following the guidelines in this means the VMs will only need to download “delta†updates, which are the differences between an existing definition set and the next one. Delta updates are typically much smaller (a few kilobytes) than a full definition download (which can average around 150 mb). - ### Manage updates for persistent VDIs If you are using a persistent VDI, you should update the base image monthly, and set up protection updates to be delivered daily via a file share, as follows: + 1. Create a dedicated file share location on your network that can be accessed by your VMs and your VM host (or other, persistent machine, such as a dedicated admin console that you use to manage your VMs). + 2. Set up a scheduled task on your VM host to automatically download updates from the MMPC website or Microsoft Update and save them to the file share (the [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4/DisplayScript) can help with this). + 3. [Configure the VMs to pull protection updates from the file share](manage-protection-updates-windows-defender-antivirus.md). + 4. Disable or delay automatic Microsoft updates on your VMs. See [Update Windows 10 in the enterprise](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-update-windows-10) for information on managing operating system updates with WSUS, SCCM, and others. + 5. On or just after each Patch Tuesday (the second Tuesday of each month), [update your base image with the latest protection updates from the MMPC website, WSUS, or Microsoft Update](manage-protection-updates-windows-defender-antivirus.md) Also apply all other Windows patches and fixes that were delivered on the Patch Tuesday. You can automate this by following the instructions in [Orchestrated offline VM Patching using Service Management Automation](https://blogs.technet.microsoft.com/privatecloud/2013/12/06/orchestrated-offline-vm-patching-using-service-management-automation/). -5. [Run a quick scan](run-scan-windows-defender-antivirus.md) on your base image before deploying it to your VMs. -A benefit to aligning your image update to the monthly Microsoft Update is that you ensure your VMs will have the latest Windows security patches and other important Microsoft updates without each VM needing to individually download them. +6. [Run a quick scan](run-scan-windows-defender-antivirus.md) on your base image before deploying it to your VMs. +A benefit to aligning your image update to the monthly Microsoft Update is that you ensure your VMs will have the latest Windows security patches and other important Microsoft updates without each VM needing to individually download them. ### Manage updates for non-persistent VDIs If you are using a non-persistent VDI, you can update the base image daily (or nightly) and directly apply the latest updates to the image. An example: + 1. Every night or other time when you can safely take your VMs offline, update your base image with the latest [protection updates from the MMPC website, WSUS, or Microsoft Update](manage-protection-updates-windows-defender-antivirus.md). + 2. [Run a quick scan](run-scan-windows-defender-antivirus.md) on your base image before deploying it to your VMs. - - - ## Configure endpoints for optimal performance + There are a number of settings that can help ensure optimal performance on your VMs and VDI without affecting the level of protection, including: - - [Randomize scheduled scans](#randomize-scheduled-scans) - - [Use quick scans](#use-quick-scans) - - [Prevent notifications](#prevent-notifications) - - [Disable scans from occurring after every update](#disable-scans-after-an-update) - - [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline) + +- [Randomize scheduled scans](#randomize-scheduled-scans) +- [Use quick scans](#use-quick-scans) +- [Prevent notifications](#prevent-notifications) +- [Disable scans from occurring after every update](#disable-scans-after-an-update) +- [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline) These settings can be configured as part of creating your base image, or as a day-to-day management function of your VDI infrastructure or network. - - - ### Randomize scheduled scans -Windows Defender AV supports the randomization of scheduled scans and signature updates. This can be extremely helpful in reducing boot storms (especially when used in conjunction with [Disable scans from occurring after every update](#disable-scans-after-an-update) and [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline). +Antivirus supports the randomization of scheduled scans and signature updates. This can be extremely helpful in reducing boot storms (especially when used in conjunction with [Disable scans from occurring after every update](#disable-scans-after-an-update) and [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline). Scheduled scans run in addition to [real-time protection and scanning](configure-real-time-protection-windows-defender-antivirus.md). @@ -177,17 +171,17 @@ The start time of the scan itself is still based on the scheduled scan policy **Use Group Policy to randomize scheduled scan start times:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. -4. Click **Policies** then **Administrative templates**. +3. Click **Policies** then **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender** and configure the following setting: - - 1. Double-click the **Randomize scheduled task times** setting and set the option to **Enabled**. Click **OK**. This adds a true randomization (it is still random if the disk image is replicated) of plus or minus 30 minutes (using all of the intervals) to the start of the scheduled scan and the signature update. For example, if the schedule start time was set at 2.30pm, then enabling this setting could cause one machine to scan and update at 2.33pm and another machine to scan and update at 2.14pm. +4. Expand the tree to **Windows components > Windows Defender** and configure the following setting: -**Use Configuration Manager to randomize schedule scans:** + - Double-click **Randomize scheduled task times** and set the option to **Enabled**. Click **OK**. This adds a true randomization (it is still random if the disk image is replicated) of plus or minus 30 minutes (using all of the intervals) to the start of the scheduled scan and the signature update. For example, if the schedule start time was set at 2.30pm, then enabling this setting could cause one machine to scan and update at 2.33pm and another machine to scan and update at 2.14pm. + +**Use Configuration Manager to randomize scheduled scans:** See [How to create and deploy antimalware policies: Advanced settings]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#advanced-settings) for details on configuring System Center Configuration Manager (current branch). @@ -196,18 +190,19 @@ See [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) for ### Use quick scans You can specify the type of scan that should be performed during a scheduled scan. -Quick scans are the preferred approach as they are designed to look in all places where malware needs to reside to be active. +Quick scans are the preferred approach as they are designed to look in all places where malware needs to reside to be active. **Use Group Policy to specify the type of scheduled scan:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. -3. Click **Policies** then **Administrative templates**. +3. Click **Policies** then **Administrative templates**. -4. Expand the tree to **Windows components > Windows Defender > Scan** and configure the following setting: - 1. Double-click the **Specify the scan type to use for a scheduled scan** setting and set the option to **Enabled** and **Quick scan**. Click **OK**. +4. Expand the tree to **Windows components > Windows Defender > Scan** and configure the following setting: + + - Double-click **Specify the scan type to use for a scheduled scan** and set the option to **Enabled** and **Quick scan**. Click **OK**. **Use Configuration Manager to specify the type of scheduled scan:** @@ -217,34 +212,34 @@ See [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) for ### Prevent notifications -Sometimes, Windows Defender AV notifications may be sent to or persist across multiple sessions. In order to minimize this problem, you can use the lock down the user interface for Windows Defender AV. +Sometimes, antivirus notifications may be sent to or persist across multiple sessions. In order to minimize this problem, you can use the lock down the antivirus user interface. **Use Group Policy to hide notifications:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. -4. Click **Policies** then **Administrative templates**. +3. Click **Policies** then **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender > Client Interface** and configure the following settings: - -1. Double-click the **Suppress all notifications** setting and set the option to **Enabled**. Click **OK**. This prevents notifications from Windows Defender AV appearing in the action center on Windows 10 when scans or remediation is performed. -2. Double-click the **Enable headless UI mode** setting and set the option to **Enabled**. Click **OK**. This hides the entire Windows Defender AV user interface from users. +4. Expand the tree to **Windows components > Windows Defender > Client Interface** and configure the following settings: + - Double-click **Suppress all notifications** and set the option to **Enabled**. Click **OK**. This prevents notifications from Windows Defender AV appearing in the action center on Windows 10 when scans or remediation is performed. + - Double-click **Enable headless UI mode** and set the option to **Enabled**. Click **OK**. This hides the entire Windows Defender AV user interface from users. **Use Configuration Manager to hide notifications:** -1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) +1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) -2. Go to the **Advanced** section and configure the following settings: +2. Go to the **Advanced** section and configure the following settings: -1. Set **Disable the client user interface** to **Yes**. This hides the entire Windows Defender AV user interface. -2. Set **Show notifications messages on the client computer...** to **Yes**. This hides notifications from appearing. + 1. Set **Disable the client user interface** to **Yes**. This hides the entire Windows Defender AV user interface. -3. Click **OK**. + 2. Set **Show notifications messages on the client computer...** to **Yes**. This hides notifications from appearing. -3. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). + 3. Click **OK**. + +3. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). ### Disable scans after an update @@ -255,68 +250,58 @@ This setting will prevent a scan from occurring after receiving an update. You c **Use Group Policy to disable scans after an update:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. -4. Click **Policies** then **Administrative templates**. +3. Click **Policies** then **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender > Signature Updates** and configure the following setting: - -1. Double-click the **Turn on scan after signature update** setting and set the option to **Disabled**. Click **OK**. This prevents a scan from running immediately after an update. +4. Expand the tree to **Windows components > Windows Defender > Signature Updates** and configure the following setting: + - Double-click **Turn on scan after signature update** and set the option to **Disabled**. Click **OK**. This prevents a scan from running immediately after an update. **Use Configuration Manager to disable scans after an update:** -1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) - -2. Go to the **Scheduled scans** section and configure the following setting: - -1. Set **Check for the latest definition updates before running a scan** to **No**. This prevents a scan after an update. - -3. Click **OK**. - -2. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). +1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) +2. Go to the **Scheduled scans** section and configure the following setting: +3. Set **Check for the latest definition updates before running a scan** to **No**. This prevents a scan after an update. +4. Click **OK**. +5. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). ### Scan VMs that have been offline -This setting will help ensure protection for a VM that has been offline for some time or has otherwise missed a scheduled scan. +This setting will help ensure protection for a VM that has been offline for some time or has otherwise missed a scheduled scan. **Use Group Policy to enable a catch-up scan:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender > Scan** and configure the following setting: - -1. Double-click the **Turn on catch-up quick scan** setting and set the option to **Enabled**. Click **OK**. This forces a scan if the VM has missed two or more consecutive scheduled scans. +2. In the **Group Policy Management Editor** go to **Computer configuration**. +3. Click **Policies** then **Administrative templates**. +4. Expand the tree to **Windows components > Windows Defender > Scan** and configure the following setting: +5. Double-click the **Turn on catch-up quick scan** setting and set the option to **Enabled**. Click **OK**. This forces a scan if the VM has missed two or more consecutive scheduled scans. **Use Configuration Manager to disable scans after an update:** -1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) +1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) -2. Go to the **Scheduled scans** section and configure the following setting: +2. Go to the **Scheduled scans** section and configure the following setting: -1. Set **Force a scan of the selected scan type if client computer is offline during...** to **Yes**. This forces a scan if the VM has missed two or more consecutive scheduled scans. - -3. Click **OK**. - -2. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). +3. Set **Force a scan of the selected scan type if client computer is offline during...** to **Yes**. This forces a scan if the VM has missed two or more consecutive scheduled scans. +4. Click **OK**. +5. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). ### Exclusions -Windows Server 2016 contains Windows Defender Antivirus and will automatically deliver the right exclusions for servers running a VDI environment. However, if you are running an older Windows server version, you can refer to the exclusions that are applied on this page: +Windows Server 2016 antivirus will automatically deliver the right exclusions for servers running a VDI environment. However, if you are running an older Windows server version, you can refer to the exclusions that are applied on this page: - [Automatic exclusions for Windows Server Antimalware](https://technet.microsoft.com/en-us/windows-server-docs/security/windows-defender/automatic-exclusions-for-windows-defender) ## Additional resources @@ -324,4 +309,4 @@ Windows Server 2016 contains Windows Defender Antivirus and will automatically d - [Video: Microsoft Senior Program Manager Bryan Keller on how System Center Configuration Manger 2012 manages VDI and integrates with App-V]( http://channel9.msdn.com/Shows/Edge/Edge-Show-5-Manage-VDI-using-SCCM-2012#time=03m02s) - [Project VRC: Antivirus impact and best practices on VDI](https://blogs.technet.microsoft.com/privatecloud/2013/12/06/orchestrated-offline-vm-patching-using-service-management-automation/) - [TechNet forums on Remote Desktop Services and VDI](https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverTS) -- [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4/DisplayScript) +- [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4/DisplayScript) diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index fa6dae36c3..1a12ff661c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -1,7 +1,7 @@ --- -title: Block Potentially Unwanted Applications with Windows Defender AV -description: Enable the Potentially Unwanted Application (PUA) feature in Windows Defender Antivirus to block unwanted software such as adware. -keywords: pua, enable, unwanted software, unwanted apps, adware, browser toolbar, detect, block, windows defender +title: Block potentially unwanted applications with antivirus +description: Enable the potentially unwanted application (PUA) antivirus feature to block unwanted software such as adware. +keywords: pua, enable, unwanted software, unwanted apps, adware, browser toolbar, detect, block, antivirus search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -14,73 +14,68 @@ ms.author: v-anbic ms.date: 07/10/2018 --- -# Detect and block Potentially Unwanted Applications - -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators +# Detect and block potentially unwanted applications **Manageability available with** +- Microsoft Intune - System Center Configuration Manager - PowerShell cmdlets -- Microsoft Intune -The Potentially Unwanted Application (PUA) protection feature in Windows Defender Antivirus can identify and block PUAs from downloading and installing on endpoints in your network. +The potentially unwanted application (PUA) antivirus protection feature can identify and block PUAs from downloading and installing on endpoints in your network. These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have a poor reputation. Typical PUA behavior includes: + - Various types of software bundling -- Ad-injection into web browsers +- Ad injection into web browsers - Driver and registry optimizers that detect issues, request payment to fix the errors, but remain on the endpoint and make no changes or optimizations (also known as "rogue antivirus" programs) These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications. >[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. +>You can also visit the Windows Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. ## How it works PUAs are blocked when a user attempts to download or install the detected file, and if the file meets one of the following conditions: + - The file is being scanned from the browser - The file is in a folder with "**downloads**" in the path - The file is in a folder with "**temp**" in the path -- The file is on the user's Desktop +- The file is on the user's desktop - The file does not meet one of these conditions and is not under *%programfiles%*, *%appdata%*, or *%windows%* -The file is placed in the quarantine section so it won't run. +The file is placed in the quarantine section so it won't run. When a PUA is detected on an endpoint, the endpoint will present a notification to the user ([unless notifications have been disabled](configure-notifications-windows-defender-antivirus.md)) in the same format as normal threat detections (prefaced with "PUA:"). They will also appear in the usual [quarantine list in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#detection-history). - ## View PUA events -PUA events are reported in the Windows Event Viewer and not in System Center Configuration Manager or Intune. +PUA events are reported in the Windows Event Viewer and not in System Center Configuration Manager or Intune. Hoever, PUA detections will be reported if you have set up email notifications for detections. See [Troubleshoot event IDs](troubleshoot-windows-defender-antivirus.md) for details on viewing Windows Defender Antivirus events. PUA events are recorded under event ID 1160. +## Configure PUA protection -## Configure the PUA protection feature +You can enable PUA protection with Microsoft Intune, System Center Configuration Manager, or PowerShell cmdlets. -You can enable the PUA protection feature with System Center Configuration Manager, PowerShell cmdlets, or Microsoft Intune. - -You can also use the PUA audit mode to detect PUA without blocking them. The detections will be captured in the Windows event log. +You can also use the PUA audit mode to detect PUA without blocking them. The detections will be captured in the Windows event log. This feature is useful if your company is conducting an internal software security compliance check and you'd like to avoid any false positives. +**Use Intune to configure the PUA protection feature** + +See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details. **Use Configuration Manager to configure the PUA protection feature:** -PUA protection is enabled by default in System Center Configuration Manager (current branch), including version 1606 and later. +PUA protection is enabled by default in System Center Configuration Manager (current branch), including version 1606 and later. See [How to create and deploy antimalware policies: Scheduled scans settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#real-time-protection-settings) for details on configuring System Center Configuration Manager (current branch). @@ -101,18 +96,9 @@ Setting the value for this cmdlet to `Enabled` will turn the feature on if it ha Setting `AuditMode` will detect PUAs but will not block them. -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. - - - -**Use Intune to configure the PUA protection feature** - -See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details. - +See [Use PowerShell cmdlets to configure and run antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. ## Related topics -- [Windows Defender Antivirus](windows-defender-antivirus-in-windows-10.md) +- [Next gen protection](windows-defender-antivirus-in-windows-10.md) - [Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md) - - diff --git a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md index da5b515967..942cf1e08c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md @@ -16,16 +16,6 @@ ms.date: 07/10/2018 # Enable cloud-delivered protection in Windows Defender AV - - -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators - **Manageability available with** - Group Policy diff --git a/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md index 225ea553da..cf3a513af4 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md @@ -16,16 +16,6 @@ ms.date: 04/30/2018 # Evaluate Windows Defender Antivirus protection - -**Applies to:** - -- Windows 10, version 1703 and later - -**Audience** - -- Enterprise security administrators - - If you're an enterprise security administrator, and you want to determine how well Windows Defender Antivirus protects you from viruses, malware, and potentially unwanted applications, then you can use this guide to help you evaluate Microsoft protection. >[!TIP] diff --git a/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md index d0d4cfd9db..41d1f3bc7a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md @@ -18,18 +18,6 @@ ms.date: 04/30/2018 # Use limited periodic scanning in Windows Defender AV - - -**Applies to:** - -- Windows 10, version 1703 and later - - -**Audience** - -- Enterprise security administrators - - **Manageability available with** - Windows Defender Security Center app diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md index a15ae25596..2976500d01 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md @@ -16,13 +16,6 @@ ms.date: 04/30/2018 # Manage event-based forced updates -**Applies to** -- Windows 10 - -**Audience** - -- Network administrators - **Manageability available with** - Group Policy diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md index 00b1ed1c2f..580f7da969 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md @@ -16,13 +16,6 @@ ms.date: 04/30/2018 # Manage updates and scans for endpoints that are out of date -**Applies to** -- Windows 10 - -**Audience** - -- Network administrators - **Manageability available with** - Group Policy diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md index 650a73dafb..ab77c652c8 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md @@ -16,13 +16,6 @@ ms.date: 04/30/2018 # Manage the schedule for when protection updates should be downloaded and applied -**Applies to** -- Windows 10 - -**Audience** - -- Network administrators - **Manageability available with** - Group Policy diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md index 5eab19050c..817e523825 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md @@ -16,13 +16,6 @@ ms.date: 04/30/2018 # Manage the sources for Windows Defender Antivirus protection updates -**Applies to** -- Windows 10 - -**Audience** - -- Enterprise security administrators - **Manageability available with** - Group Policy diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 99051e2f5f..96f18fc71c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -16,15 +16,6 @@ ms.date: 04/30/2018 # Manage Windows Defender Antivirus updates and apply baselines - -**Applies to:** - -- Windows 10 - -**Audience** - -- Network administrators - There are two types of updates related to keeping Windows Defender Antivirus: 1. Protection updates 2. Product updates diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md index de30dd760f..cf9c23f821 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md @@ -16,13 +16,6 @@ ms.date: 04/30/2018 # Manage updates for mobile devices and virtual machines (VMs) -**Applies to** -- Windows 10 - -**Audience** - -- Network administrators - **Manageability available with** - Group Policy diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md index d0306388a6..1a1656a70c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md @@ -15,18 +15,6 @@ ms.date: 04/30/2018 --- # Prevent users from seeing or interacting with the Windows Defender AV user interface -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators - -**Manageability available with** - -- Group Policy - You can use Group Policy to prevent users on endpoints from seeing the Windows Defender Antivirus interface. You can also prevent them from pausing scans. diff --git a/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md index 79696c63e9..2593dfcfbc 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md @@ -16,14 +16,6 @@ ms.date: 07/10/2018 # Report on Windows Defender Antivirus protection -**Applies to:** - -- Windows 10 - -**Audience** - -- IT administrators - There are a number of ways you can review protection status and alerts, depending on the management tool you are using for Windows Defender AV. diff --git a/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md index db4d6528c0..98c30a78fa 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md @@ -16,16 +16,6 @@ ms.date: 04/23/2018 # Restore quarantined files in Windows Defender AV - -**Applies to:** - -- Windows 10 -- Windows Server 2016 - -**Audience** - -- Enterprise security administrators - **Manageability available with** - Windows Defender Security Center diff --git a/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md index 151f4e6a10..92a0fd512b 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md @@ -16,15 +16,6 @@ ms.date: 07/10/2018 # Review Windows Defender AV scan results - -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators - **Manageability available with** - PowerShell diff --git a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md index 4aa2447988..f2d0786031 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md @@ -14,20 +14,8 @@ ms.author: v-anbic ms.date: 07/10/2018 --- - - - - # Configure and run on-demand Windows Defender AV scans -**Applies to:** - -- Windows 10 - -**Audience** - -- Enterprise security administrators - **Manageability available with** - Windows Defender AV mpcmdrun utility diff --git a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md index 8e4b44e881..7763632674 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md @@ -14,16 +14,8 @@ ms.author: v-anbic ms.date: 07/26/2018 --- - # Configure scheduled quick or full scans for Windows Defender AV - - -**Applies to** -- Windows 10 - -**Audience** - - Enterprise security administrators **Manageability available with** diff --git a/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md index b2b7a4640f..b497ea1b52 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md @@ -16,16 +16,6 @@ ms.date: 07/19/2018 # Specify the cloud-delivered protection level - - -**Applies to:** - -- Windows 10, version 1703 and later - -**Audience** - -- Enterprise security administrators - **Manageability available with** - Group Policy diff --git a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md index 28d890360d..a01cb86821 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md +++ b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md @@ -16,14 +16,6 @@ ms.date: 04/30/2018 # Troubleshoot Windows Defender Antivirus reporting in Update Compliance -**Applies to:** - -- Windows 10 - -**Audience** - -- IT administrators - When you use [Windows Analytics Update Compliance to obtain reporting into the protection status of machines or endpoints](/windows/deployment/update/update-compliance-using#wdav-assessment) in your network that are using Windows Defender Antivirus, you may encounter problems or issues. Typically, the most common indicators of a problem are: diff --git a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md index c71d3ab6c0..47304df20b 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md @@ -16,16 +16,6 @@ ms.date: 04/16/2018 # Review event logs and error codes to troubleshoot issues with Windows Defender AV - -**Applies to** -- Windows 10 -- Windows Server 2016 - -**Audience** - -- Enterprise security administrators - - If you encounter a problem with Windows Defender Antivirus, you can search the tables in this topic to find a matching issue and potential solution. The tables list: diff --git a/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md index f13977e93c..07fd41556e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md @@ -16,10 +16,6 @@ ms.date: 04/30/2018 # Use Group Policy settings to configure and manage Windows Defender AV -**Applies to:** - -- Windows 10, version 1703 - You can use [Group Policy](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx) to configure and manage Windows Defender Antivirus on your endpoints. In general, you can use the following procedure to configure or change Windows Defender AV group policy settings: diff --git a/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md index 8a77b98ed5..6b52050663 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md @@ -16,10 +16,6 @@ ms.date: 12/12/2017 # Use PowerShell cmdlets to configure and manage Windows Defender AV -**Applies to:** - -- Windows 10 - You can use PowerShell to perform various functions in Windows Defender. Similar to the command prompt or command line, PowerShell is a task-based command-line shell and scripting language designed especially for system administration, and you can read more about it at the [PowerShell hub on MSDN](https://msdn.microsoft.com/en-us/powershell/mt173057.aspx). For a list of the cmdlets and their functions and available parameters, see the [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) topic. diff --git a/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md index f8c35eb6c8..49e0f3ed58 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md @@ -16,10 +16,6 @@ ms.date: 08/26/2017 # Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV -**Applies to:** - -- Windows 10 - Windows Management Instrumentation (WMI) is a scripting interface that allows you to retrieve, modify, and update settings. Read more about WMI at the [Microsoft Developer Network System Administration library](https://msdn.microsoft.com/en-us/library/aa394582(v=vs.85).aspx). diff --git a/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md index fc5487d680..85c7d94504 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md @@ -16,14 +16,6 @@ ms.date: 05/21/2018 # Use next-gen technologies in Windows Defender Antivirus through cloud-delivered protection -**Applies to:** - -- Windows 10, version 1703 and later - -**Audience** - -- Enterprise security administrators - Microsoft next-gen technologies in Windows Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models. To take advantage of the power and speed of these next-gen technologies, Windows Defender Antivirus works seamlessly with Microsoft cloud services. These cloud protection services, also referred to as Microsoft Advanced Protection Service (MAPS), enhances standard real-time protection, providing arguably the best antivirus defense. diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index db9fd10f0d..2b1d16786f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -14,20 +14,8 @@ ms.author: v-anbic ms.date: 04/04/2018 --- - # Windows Defender Antivirus compatibility - -**Applies to:** - -- Windows 10 -- Windows Server 2016 - -**Audience** - -- Enterprise security administrators - - Windows Defender Antivirus is automatically enabled and installed on endpoints and devices that are running Windows 10. However, on endpoints and devices that are protected with a non-Microsoft antivirus or antimalware app, Windows Defender AV will automatically disable itself. You can then choose to enable an optional, limited protection feature, called [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md). diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md index ae39992504..9247f9c8fc 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md @@ -16,10 +16,6 @@ ms.date: 04/30/2018 # Windows Defender Antivirus in Windows 10 and Windows Server 2016 -**Applies to** -- Windows 10 -- Windows Server 2016 - Windows Defender Antivirus is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers. This library of documentation is for enterprise security administrators who are either considering deployment, or have already deployed and are wanting to manage and configure Windows Defender AV on PC endpoints in their network. diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md index f8fb6d41ba..3bbd7bccdb 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md @@ -14,20 +14,8 @@ ms.author: v-anbic ms.date: 04/11/2018 --- - # Windows Defender Antivirus on Windows Server 2016 - -**Applies to:** - -- Windows Server 2016 - -**Audience** - -- Enterprise security administrators -- Network administrators - - **Manageability available with** - Group Policy diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md index c58ed524ef..9d0cd80d8a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md @@ -16,15 +16,6 @@ ms.date: 04/30/2018 # Run and review the results of a Windows Defender Offline scan - -**Applies to:** - -- Windows 10, version 1607 and later - -**Audience** - -- Enterprise security administrators - **Manageability available with** - Group Policy diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md index e7349b1a3f..f62d4f5e57 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md @@ -16,14 +16,6 @@ ms.date: 04/30/2018 # Windows Defender Antivirus in the Windows Defender Security Center app -**Applies to** - -- Windows 10, version 1703 and later - -**Audience** - -- End-users - **Manageability available with** - Windows Defender Security Center app From b85686248d8658ef463130d9741623fc0d834bad Mon Sep 17 00:00:00 2001 From: Andrea Bichsel <35236577+andreabichsel@users.noreply.github.com> Date: Thu, 9 Aug 2018 17:06:59 -0700 Subject: [PATCH 050/286] TOC changes --- windows/security/threat-protection/TOC.md | 62 ++++++++++------------- 1 file changed, 27 insertions(+), 35 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 41beae5c7e..72e7964acf 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -58,48 +58,40 @@ +#### [Configure next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) +##### [Next generation protection in Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) +##### [Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) +###### [Use limited periodic scanning](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) +##### [Deploy next generation protection](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) +###### [Deploy and enable next generation protection](windows-defender-antivirus\deploy-windows-defender-antivirus.md) +###### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) +##### [Report on next generation protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) +###### [Troubleshoot antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) +##### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) +###### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) +###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) +###### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) +###### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) +###### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) - - - - - - -#### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) -##### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) -##### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) -###### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) - -##### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md) -###### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md) -####### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md) -###### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md) -####### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md) -###### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md) -####### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md) -####### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md) -####### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md) -####### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md) -####### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md) - -##### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) -###### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) +##### [Manage scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md) +###### [Configure and validate exclusions in antivirus scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md) ####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md) ####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md) -####### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) -###### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) +####### [Configure antivirus exclusions on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md) +###### [Configure scanning options](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md) ###### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md) ###### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md) ###### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md) ###### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md) -###### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md) -##### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) -##### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) -###### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) -###### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) -###### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) -###### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) -###### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) +###### [Run and review the results of an offline scan](windows-defender-antivirus\windows-defender-offline.md) +###### [Restore quarantined files](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md) +##### [Manage next generation protection in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md) +###### [Use Microsoft Intune and System Center Configuration Manager to manage next generation protection](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md) +###### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md) +###### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md) +###### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md) +###### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md) From 82de7e4fb5b2c034bbf073a77483621b9b886b3a Mon Sep 17 00:00:00 2001 From: Andrea Bichsel <35236577+andreabichsel@users.noreply.github.com> Date: Thu, 9 Aug 2018 18:19:20 -0700 Subject: [PATCH 051/286] Content reorg and rebranding changes --- ...d-protection-windows-defender-antivirus.md | 105 +++++----- .../evaluate-windows-defender-antivirus.md | 25 +-- ...dic-scanning-windows-defender-antivirus.md | 27 +-- ...ased-updates-windows-defender-antivirus.md | 121 +++++------ ...ed-endpoints-windows-defender-antivirus.md | 60 +++--- ...ate-schedule-windows-defender-antivirus.md | 47 +++-- ...tion-updates-windows-defender-antivirus.md | 10 +- ...es-baselines-windows-defender-antivirus.md | 8 +- ...-devices-vms-windows-defender-antivirus.md | 8 +- ...-interaction-windows-defender-antivirus.md | 12 +- ...port-monitor-windows-defender-antivirus.md | 12 +- ...ntined-files-windows-defender-antivirus.md | 4 +- ...scan-results-windows-defender-antivirus.md | 31 +-- .../run-scan-windows-defender-antivirus.md | 32 ++- ...tch-up-scans-windows-defender-antivirus.md | 16 +- ...ection-level-windows-defender-antivirus.md | 49 ++--- .../troubleshoot-reporting.md | 14 +- ...troubleshoot-windows-defender-antivirus.md | 189 +++++++++--------- ...group-policy-windows-defender-antivirus.md | 98 ++++----- ...nfig-manager-windows-defender-antivirus.md | 10 +- ...hell-cmdlets-windows-defender-antivirus.md | 8 +- .../use-wmi-windows-defender-antivirus.md | 10 +- 22 files changed, 428 insertions(+), 468 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md index 942cf1e08c..6359c757d2 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md @@ -14,61 +14,74 @@ ms.author: v-anbic ms.date: 07/10/2018 --- -# Enable cloud-delivered protection in Windows Defender AV +# Enable cloud-delivered protection **Manageability available with** -- Group Policy +- Microsoft Intune - System Center Configuration Manager +- Group Policy - PowerShell cmdlets - Windows Management Instruction (WMI) -- Microsoft Intune - Windows Defender Security Center app +>[!NOTE] +>The antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional signature updates. ->[!NOTE] ->The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional signature updates. +You can enable or disable antivirus cloud-delivered protection with Microsoft Intune, System Center Configuration Manager, Group Policy, PowerShell cmdlets, or on individual clients in the Windows Defender Security Center app. +See [Use Microsoft cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for an overview of Windows Defender Antivirus cloud-delivered protection. - -You can enable or disable Windows Defender Antivirus cloud-delivered protection with Group Policy, System Center Configuration Manager, PowerShell cmdlets, Microsoft Intune, or on individual clients in the Windows Defender Security Center app. - -See [Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for an overview of Windows Defender Antivirus cloud-delivered protection. - -There are specific network-connectivity requirements to ensure your endpoints can connect to the cloud-delivered protection service. See [Configure and validate network connections for Windows Defender AV](configure-network-connections-windows-defender-antivirus.md) for more details. +There are specific network-connectivity requirements to ensure your endpoints can connect to the cloud-delivered protection service. See [Configure and validate network connections](configure-network-connections-windows-defender-antivirus.md) for more details. >[!NOTE] >In Windows 10, there is no difference between the **Basic** and **Advanced** options described in this topic. This is a legacy distinction and choosing either setting will result in the same level of cloud-delivered protection. There is no difference in the type or amount of information that is shared. See the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=521839) for more information on what we collect. +**Use Intune to enable cloud-delivered protection** -**Use Group Policy to enable cloud-delivered protection:** +1. Sign in to the [Azure portal](https://portal.azure.com). +2. Select **All services > Intune**. +3. In the **Intune** pane, select **Device configuration > Profiles**, and then select the **Device restrictions** profile type you want to configure. If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure). +4. Select **Properties**, select **Settings: Configure**, and then select **Windows Defender Antivirus**. +5. On the **Cloud-delivered protection** switch, select **Enable**. +6. In the **Prompt users before sample submission** dropdown, select **Send all data without prompting**. +7. In the **Submit samples consent** dropdown, select one of the following: -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > MAPS** - -1. Double-click the **Join Microsoft MAPS** setting and ensure the option is enabled and set to **Basic MAPS** or **Advanced MAPS**. Click **OK**. - -1. Double-click the **Send file samples when further analysis is required** setting and ensure the option is set to **Enabled** and the additional options are either of the following: - - 1. **Send safe samples** (1) - 1. **Send all samples** (3) + - **Send safe samples automatically** + - **Send all samples automatically** > [!WARNING] - > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function. - -1. Click **OK**. + > Setting to **Always Prompt** will lower the protection state of the device. Setting to **Never send** means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function. +8. Click **OK** to exit the **Windows Defender Antivirus** settings pane, click **OK** to exit the **Device restrictions** pane, and then click **Save** to save the changes to your **Device restrictions** profile. +For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/en-us/intune/device-profiles) **Use Configuration Manager to enable cloud-delivered protection:** See [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) for details on configuring System Center Configuration Manager (current branch). +**Use Group Policy to enable cloud-delivered protection:** + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Administrative templates**. + +4. Expand the tree to **Windows components > Windows Defender Antivirus > MAPS** + +5. Double-click **Join Microsoft MAPS** and ensure the option is enabled and set to **Basic MAPS** or **Advanced MAPS**. Click **OK**. + +6. Double-click **Send file samples when further analysis is required** and ensure the option is set to **Enabled** and the additional options are either of the following: + + 1. **Send safe samples** (1) + 2. **Send all samples** (3) + + > [!WARNING] + > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function. + +7. Click **OK**. **Use PowerShell cmdlets to enable cloud-delivered protection:** @@ -78,10 +91,10 @@ Use the following cmdlets to enable cloud-delivered protection: Set-MpPreference -MAPSReporting Advanced Set-MpPreference -SubmitSamplesConsent Always ``` + >[!NOTE] >You can also set -SubmitSamplesConsent to `None`. Setting it to `Never` will lower the protection state of the device, and setting it to 2 means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function. - See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. **Use Windows Management Instruction (WMI) to enable cloud-delivered protection:** @@ -96,36 +109,18 @@ SubmitSamplesConsent See the following for more information and allowed parameters: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) -**Use Intune to enable cloud-delivered protection** - -1. Sign in to the [Azure portal](https://portal.azure.com). -2. Select **All services > Intune**. -3. In the **Intune** pane, select **Device configuration > Profiles**, and then select the **Device restrictions** profile type you want to configure. If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure). -4. Select **Properties**, select **Settings: Configure**, and then select **Windows Defender Antivirus**. -5. On the **Cloud-delivered protection** switch, select **Enable**. -6. In the **Prompt users before sample submission** dropdown, select **Send all data without prompting**. -7. In the **Submit samples consent** dropdown, select one of the following: - 1. **Send safe samples automatically** - 2. **Send all samples automatically** - - > [!WARNING] - > Setting to **Always Prompt** will lower the protection state of the device. Setting to **Never send** means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function. -8. Click **OK** to exit the **Windows Defender Antivirus** settings pane, click **OK** to exit the **Device restrictions** pane, and then click **Save** to save the changes to your **Device restrictions** profile. - -For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/en-us/intune/device-profiles) - **Enable cloud-delivered protection on individual clients with the Windows Defender Security Center app** + > [!NOTE] > If the **Configure local setting override for reporting Microsoft MAPS** Group Policy setting is set to **Disabled**, then the **Cloud-based protection** setting in Windows Settings will be greyed-out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. - 1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: -![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center app](images/defender/wdav-protection-settings-wdsc.png) - -3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. + ![Screenshot of the Virus & threat protection settings label in the Windows Defender Security Center app](images/defender/wdav-protection-settings-wdsc.png) + +3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. >[!NOTE] >If automatic sample submission has been configured with Group Policy then the setting will be greyed-out and unavailable. @@ -133,10 +128,10 @@ For more information about Intune device profiles, including how to create and c ## Related topics - [Configure the cloud block timeout period](configure-cloud-block-timeout-period-windows-defender-antivirus.md) -- [Configure the block at first sight feature](configure-block-at-first-sight-windows-defender-antivirus.md) -- [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) +- [Configure block at first sight](configure-block-at-first-sight-windows-defender-antivirus.md) +- [Use PowerShell cmdlets to manage next generation protection](use-powershell-cmdlets-windows-defender-antivirus.md) - [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune)] - [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) - [Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) - [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md index cf3a513af4..a2f5add295 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Evaluate Windows Defender Antivirus +title: Evaluate next generation protection description: Businesses of all sizes can use this guide to evaluate and test the protection offered by Windows Defender Antivirus in Windows 10. keywords: windows defender antivirus, cloud protection, cloud, antimalware, security, defender, evaluate, test, protection, compare, real-time protection search.product: eADQiWindows 10XVcnh @@ -14,37 +14,34 @@ ms.author: v-anbic ms.date: 04/30/2018 --- -# Evaluate Windows Defender Antivirus protection +# Evaluate next generation protection -If you're an enterprise security administrator, and you want to determine how well Windows Defender Antivirus protects you from viruses, malware, and potentially unwanted applications, then you can use this guide to help you evaluate Microsoft protection. +Use this guide to determine how well next generation protection protects you from viruses, malware, and potentially unwanted applications. >[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work: +>You can also visit the Windows Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work: >- Cloud-delivered protection >- Fast learning (including Block at first sight) >- Potentially unwanted application blocking - -It explains the important features available for both small and large enterprises in Windows Defender, and how they will increase malware detection and protection across your network. +It explains the important next generation protection features available for both small and large enterprises, and how they increase malware detection and protection across your network. You can choose to configure and evaluate each setting independently, or all at once. We have grouped similar settings based upon typical evaluation scenarios, and include instructions for using PowerShell to enable the settings. The guide is available in PDF format for offline viewing: + - [Download the guide in PDF format](https://www.microsoft.com/download/details.aspx?id=54795) You can also download a PowerShell that will enable all the settings described in the guide automatically. You can obtain the script alongside the PDF download above, or individually from PowerShell Gallery: + - [Download the PowerShell script to automatically configure the settings](https://www.powershellgallery.com/packages/WindowsDefender_InternalEvaluationSettings/1.2/DisplayScript) > [!IMPORTANT] -> The guide is currently intended for single-machine evaluation of Windows Defender Antivirus protection. Enabling all of the settings in this guide may not be suitable for real-world deployment. +> The guide is currently intended for single-machine evaluation of next generation protection. Enabling all of the settings in this guide may not be suitable for real-world deployment. > -> For the latest recommendations for real-world deployment and monitoring of Windows Defender Antivirus across a network, see the [Deploy, manage, and report](deploy-manage-report-windows-defender-antivirus.md) topic in this library. - +> For the latest recommendations for real-world deployment and monitoring of next generation protection across a network, see [Deploy next generation](deploy-manage-report-windows-defender-antivirus.md). ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) -- [Deploy, manage, and report](deploy-manage-report-windows-defender-antivirus.md) - - - +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Deploy next generation protection](deploy-manage-report-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md index 41d1f3bc7a..b4e0eec31a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Enable the limited periodic scanning feature in Windows Defender AV -description: Limited periodic scanning lets you use Windows Defender AV in addition to your other installed AV providers +title: Enable the limited periodic antivirus scanning feature +description: Limited periodic scanning lets you use next generation protection in addition to your other installed AV providers keywords: lps, limited, periodic, scan, scanning, compatibility, 3rd party, other av, disable search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -16,46 +16,39 @@ ms.date: 04/30/2018 -# Use limited periodic scanning in Windows Defender AV +# Use limited periodic scanning in next generation protection **Manageability available with** - Windows Defender Security Center app - Limited periodic scanning is a special type of threat detection and remediation that can be enabled when you have installed another antivirus product on a Windows 10 device. -It can only be enabled in certain situations. See the [Windows Defender Antivirus compatibility](windows-defender-antivirus-compatibility.md) topic for more information on when limited periodic scanning can be enabled, and how Windows Defender Antivirus works with other AV products. +It can only be enabled in certain situations. See [Antivirus compatibility](windows-defender-antivirus-compatibility.md) for more information on when limited periodic scanning can be enabled, and how next generation protection works with other AV products. -**Microsoft does not recommend using this feature in enterprise environments. This is a feature primarily intended for consumers.** This feature only uses a very limited subset of the capabilities of Windows Defender Antivirus to detect malware, and will not be able to detect most malware and potentially unwanted software. Also, management and reporting capabilities will be limited. Microsoft recommends enterprises choose their primary antivirus solution and use it exclusively. +**Microsoft does not recommend using this feature in enterprise environments. This is a feature primarily intended for consumers.** This feature only uses a very limited subset of the antivirus capabilities to detect malware, and will not be able to detect most malware and potentially unwanted software. Also, management and reporting capabilities will be limited. Microsoft recommends enterprises choose their primary antivirus solution and use it exclusively. ## How to enable limited periodic scanning -By default, Windows Defender AV will enable itself on a Windows 10 device if there is no other antivirus product installed, or if the other AV product is out-of-date, expired, or not working correctly. +By default, antivirus will enable itself on a Windows 10 device if there is no other antivirus product installed, or if the other product is out-of-date, expired, or not working correctly. -If Windows Defender AV is enabled, the usual options will appear to configure Windows Defender AV on that device: +If antivirus is enabled, the usual options will appear to configure it on that device: ![Windows Defender Security Center app showing Windows Defender AV options, including scan options, settings, and update options](images/vtp-wdav.png) - -If another AV product is installed and working correctly, Windows Defender AV will disable itself. The Windows Defender Security Center app will change the **Virus & threat protection** section to show status about the AV product, and provide a link to the product's configuration options: +If another antivirus product is installed and working correctly, Windows antivirus will disable itself. The Windows Defender Security Center app will change the **Virus & threat protection** section to show status about the AV product, and provide a link to the product's configuration options: ![Windows Defender Security Center app showing ContosoAV as the installed and running antivirus provider. There is a single link to open ContosoAV settings.](images/vtp-3ps.png) Underneath any 3rd party AV products, a new link will appear as **Windows Defender Antivirus options**. Clicking this link will expand to show the toggle that enables limited periodic scanning. - ![The limited periodic option is a toggle to enable or disable **periodic scanning**](images/vtp-3ps-lps.png) Sliding the swtich to **On** will show the standard Windows Defender AV options underneath the 3rd party AV product. The limited periodic scanning option will appear at the bottom of the page. - -![When enabled, periodic scanning shows the normal Windows Defender AV options](images/vtp-3ps-lps-on.png) - - - +![When enabled, periodic scanning shows the normal antivirus options](images/vtp-3ps-lps-on.png) ## Related topics - [Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md index 2976500d01..1abf8810ee 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Apply Windows Defender AV updates after certain events -description: Manage how Windows Defender Antivirus applies proteciton updates after startup or receiving cloud-delivered detection reports. +title: Apply next generation protection updates after certain events +description: Manage how antivirus applies protection updates after startup or receiving cloud-delivered detection reports. keywords: updates, protection, force updates, events, startup, check for latest, notifications search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -18,43 +18,40 @@ ms.date: 04/30/2018 **Manageability available with** -- Group Policy - System Center Configuration Manager +- Group Policy - PowerShell cmdlets - Windows Management Instruction (WMI) - -Windows Defender AV allows you to determine if updates should (or should not) occur after certain events, such as at startup or after receiving specific reports from the cloud-delivered protection service. - +Next generation protection allows you to determine if updates should (or should not) occur after certain events, such as at startup or after receiving specific reports from the cloud-delivered protection service. ## Check for protection updates before running a scan -You can use Group Policy, Configuration Manager, PowerShell cmdlets, and WMI to force Windows Defender AV to check and download protection updates before running a scheduled scan. - - -**Use Group Policy to check for protection updates before running a scan:** - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Scan**. - -6. Double-click the **Check for the latest virus and spyware definitions before running a scheduled scan** setting and set the option to **Enabled**. - -7. Click **OK**. +You can use System Center Configuration Manager, Group Policy, PowerShell cmdlets, and WMI to force antivirus to check and download protection updates before running a scheduled scan. **Use Configuration Manager to check for protection updates before running a scan:** -1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) +1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) -2. Go to the **Scheduled scans** section and set **Check for the latest definition updates before running a scan** to **Yes**. +2. Go to the **Scheduled scans** section and set **Check for the latest definition updates before running a scan** to **Yes**. 3. Click **OK**. -4. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). +4.[Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). + +**Use Group Policy to check for protection updates before running a scan:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Policies** then **Administrative templates**. + +4. Expand the tree to **Windows components > Windows Defender Antivirus > Scan**. + +5. Double-click **Check for the latest virus and spyware definitions before running a scheduled scan** and set the option to **Enabled**. + +6. Click **OK**. **Use PowerShell cmdlets to check for protection updates before running a scan:** @@ -66,7 +63,6 @@ Set-MpPreference -CheckForSignaturesBeforeRunningScan See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. - **Use Windows Management Instruction (WMI) to check for protection updates before running a scan** Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: @@ -78,46 +74,39 @@ CheckForSignaturesBeforeRunningScan See the following for more information: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) - - - - - ## Check for protection updates on startup -You can use Group Policy to force Windows Defender AV to check and download protection updates when the machine is started. +You can use Group Policy to force antivirus to check and download protection updates when the machine is started. -**Use Group Policy to download protection updates at startup:** +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +3. Click **Policies** then **Administrative templates**. -4. Click **Policies** then **Administrative templates**. +4. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**. +5. Double-click **Check for the latest virus and spyware definitions on startup** and set the option to **Enabled**. -5. Double-click the **Check for the latest virus and spyware definitions on startup** setting and set the option to **Enabled**. +6. Click **OK**. -6. Click **OK**. +You can also use Group Policy, PowerShell, or WMI to configure antivirus to check for updates at startup even when it is not running. -You can also use Group Policy, PowerShell, or WMI to configure Windows Defender AV to check for updates at startup even when it is not running. +**Use Group Policy to download updates when Windows antivirus is not present:** -**Use Group Policy to download updates when Windows Defender AV is not present:** +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +3. Click **Policies** then **Administrative templates**. -4. Click **Policies** then **Administrative templates**. +4. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**. +5. Double-click **Initiate definition update on startup** and set the option to **Enabled**. -6. Double-click the **Initiate definition update on startup** setting and set the option to **Enabled**. +6. Click **OK**. -7. Click **OK**. - -**Use PowerShell cmdlets to download updates when Windows Defender AV is not present:** +**Use PowerShell cmdlets to download updates when Windows antivirus is not present:** Use the following cmdlets: @@ -125,10 +114,9 @@ Use the following cmdlets: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine ``` -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. +See [Use PowerShell cmdlets to manage next generation protection](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. - -**Use Windows Management Instruction (WMI) to download updates when Windows Defender AV is not present:** +**Use Windows Management Instruction (WMI) to download updates when Windows antivirus not present:** Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: @@ -139,11 +127,8 @@ SignatureDisableUpdateOnStartupWithoutEngine See the following for more information: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) - - - - + ## Allow ad hoc changes to protection based on cloud-delivered protection Windows Defender AV can make changes to its protection based on cloud-delivered protection. This can occur outside of normal or scheduled protection updates. @@ -152,27 +137,21 @@ If you have enabled cloud-delivered protection, Windows Defender AV will send fi **Use Group Policy to automatically download recent updates based on cloud-delivered protection:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates** and configure the following: - 1. Double-click the **Allow real-time definition updates based on reports to Microsoft MAPS** setting and set the option to **Enabled**. Click **OK**. - 2. Double-click the **Allow notifications to disable definitions based reports to Microsoft MAPS** setting and set the option to **Enabled**. Click **OK**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. +3. Click **Policies** then **Administrative templates**. +4. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates** and configure the following: + 1. Double-click **Allow real-time definition updates based on reports to Microsoft MAPS** and set the option to **Enabled**. Click **OK**. + 2. Double-click **Allow notifications to disable definitions based reports to Microsoft MAPS** and set the option to **Enabled**. Click **OK**. ## Related topics -- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) -- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) -- [Manage Windows Defender Antivirus protection and definition updates](manage-protection-updates-windows-defender-antivirus.md) +- [Deploy next generation protection](deploy-manage-report-windows-defender-antivirus.md) +- [Manage next generation protection updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) - [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) - [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) - [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) - - - +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md index 580f7da969..6bb21857f5 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md @@ -18,36 +18,47 @@ ms.date: 04/30/2018 **Manageability available with** -- Group Policy - System Center Configuration Manager +- Group Policy - PowerShell cmdlets - Windows Management Instruction (WMI) - - -Windows Defender AV lets you define how long an endpoint can avoid an update or how many scans it can miss before it is required to update and scan itself. This is especially useful in environments where devices are not often connected to a corporate or external network, or devices that are not used on a daily basis. +Next generation protection lets you define how long an endpoint can avoid an update or how many scans it can miss before it is required to update and scan itself. This is especially useful in environments where devices are not often connected to a corporate or external network, or devices that are not used on a daily basis. For example, an employee that uses a particular PC is on break for three days and does not log on to their PC during that time. -When the user returns to work and logs on to their PC, Windows Defender AV will immediately check and download the latest protection updates, and run a scan. +When the user returns to work and logs on to their PC, antivirus will immediately check and download the latest protection updates, and run a scan. ## Set up catch-up protection updates for endpoints that haven't updated for a while -If Windows Defender AV did not download protection updates for a specified period, you can set it up to automatically check and download the latest update at the next log on. This is useful if you have [globally disabled automatic update downloads on startup](manage-event-based-updates-windows-defender-antivirus.md). +If antivirus did not download protection updates for a specified period, you can set it up to automatically check and download the latest update at the next log on. This is useful if you have [globally disabled automatic update downloads on startup](manage-event-based-updates-windows-defender-antivirus.md). + +**Use Configuration Manager to configure catch-up protection updates:** + +1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) + +2. Go to the **Definition updates** section and configure the following settings: + + 1. Set **Force a definition update if the client computer is offline for more than two consecutive scheduled updates** to **Yes**. + 2. For the **If Configuration Manager is used as a source for definition updates...**, specify the hours before which the protection updates delivered by Configuration Manager should be considered out-of-date. This will cause the next update location to be used, based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order). + +3. Click **OK**. + +4. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). **Use Group Policy to enable and configure the catch-up update feature:** -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. -4. Click **Policies** then **Administrative templates**. +3. Click **Policies** then **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**. +4. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**. -6. Double-click the **Define the number of days after which a catch-up definition update is required** setting and set the option to **Enabled**. Enter the number of days after which you want Windows Defender AV to check for and download the latest protection update. +5. Double-click the **Define the number of days after which a catch-up definition update is required** setting and set the option to **Enabled**. Enter the number of days after which you want Windows Defender AV to check for and download the latest protection update. -7. Click **OK**. +6. Click **OK**. **Use PowerShell cmdlets to configure catch-up protection updates:** @@ -71,23 +82,11 @@ See the following for more information and allowed parameters: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) -**Use Configuration Manager to configure catch-up protection updates:** - -1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) - -2. Go to the **Definition updates** section and configure the following settings: - - 1. Set **Force a definition update if the client computer is offline for more than two consecutive scheduled updates** to **Yes**. - 2. For the **If Configuration Manager is used as a source for definition updates...**, specify the hours before which the protection updates delivered by Configuration Manager should be considered out-of-date. This will cause the next update location to be used, based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order). - -3. Click **OK**. - -4. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). ## Set the number of days before protection is reported as out-of-date -You can also specify the number of days after which Windows Defender AV protection is considered old or out-of-date. After the specified number of days, the client will report itself as out-of-date, and show an error to the user of the PC. It may also cause Windows Defender AV to attempt to download an update from other sources (based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order)), such as when using MMPC as a secondary source after setting WSUS or Microsoft Update as the first source. +You can also specify the number of days after which antivirus protection is considered old or out-of-date. After the specified number of days, the client will report itself as out-of-date, and show an error to the user of the PC. It may also cause antivirus to attempt to download an update from other sources (based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order)), such as when using MMPC as a secondary source after setting WSUS or Microsoft Update as the first source. **Use Group Policy to specify the number of days before protection is considered out-of-date:** @@ -112,7 +111,7 @@ You can also specify the number of days after which Windows Defender AV protecti ## Set up catch-up scans for endpoints that have not been scanned for a while -You can set the number of consecutive scheduled scans that can be missed before Windows Defender AV will force a scan. +You can set the number of consecutive scheduled scans that can be missed before antivirus will force a scan. The process for enabling this feature is: @@ -152,7 +151,7 @@ Set-MpPreference -DisableCatchupQuickScan ``` -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. +See [Use PowerShell cmdlets to manage next generation protection](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. **Use Windows Management Instruction (WMI) to configure catch-up scans:** @@ -180,10 +179,9 @@ See the following for more information and allowed parameters: ## Related topics -- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) -- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) -- [Manage Windows Defender Antivirus protection and definition updates](manage-protection-updates-windows-defender-antivirus.md) +- [Deploy next generation protection](deploy-manage-report-windows-defender-antivirus.md) +- [Manage next generation protection updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) - [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) - [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) - [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md index ab77c652c8..5ccda8b7e5 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md @@ -18,13 +18,13 @@ ms.date: 04/30/2018 **Manageability available with** -- Group Policy - System Center Configuration Manager +- Group Policy - PowerShell cmdlets - Windows Management Instruction (WMI) -Windows Defender AV lets you determine when it should look for and download updates. +Next generation protection lets you determine when it should look for and download updates. You can schedule updates for your endpoints by: @@ -34,24 +34,6 @@ You can schedule updates for your endpoints by: You can also randomize the times when each endpoint checks and downloads protection updates. See the [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) topic for more information. -**Use Group Policy to schedule protection updates:** - -> [!IMPORTANT] -> By default, Windows Defender AV will check for an update 15 minutes before the time of any scheduled scans. Enabling these settings will override that default. - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates** and configure the following settings: - - 1. Double-click the **Specify the interval to check for definition updates** setting and set the option to **Enabled**. Enter the number of hours between updates. Click **OK**. - 2. Double-click the **Specify the day of the week to check for definition updates** setting and set the option to **Enabled**. Enter the day of the week to check for updates. Click **OK**. - 3. Double-click the **Specify the time to check for definition updates** setting and set the option to **Enabled**. Enter the time when updates should be checked. The time is based on the local time of the endpoint. Click **OK**. - - **Use Configuration Manager to schedule protection updates:** 1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) @@ -66,6 +48,24 @@ You can also randomize the times when each endpoint checks and downloads protect 5. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). +**Use Group Policy to schedule protection updates:** + +> [!IMPORTANT] +> By default, antivirus will check for an update 15 minutes before the time of any scheduled scans. Enabling these settings will override that default. + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates** and configure the following settings: + + 1. Double-click the **Specify the interval to check for definition updates** setting and set the option to **Enabled**. Enter the number of hours between updates. Click **OK**. + 2. Double-click the **Specify the day of the week to check for definition updates** setting and set the option to **Enabled**. Enter the day of the week to check for updates. Click **OK**. + 3. Double-click the **Specify the time to check for definition updates** setting and set the option to **Enabled**. Enter the time when updates should be checked. The time is based on the local time of the endpoint. Click **OK**. + + **Use PowerShell cmdlets to schedule protection updates:** @@ -95,13 +95,12 @@ See the following for more information and allowed parameters: ## Related topics -- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) -- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) -- [Manage Windows Defender Antivirus protection and definition updates](manage-protection-updates-windows-defender-antivirus.md) +- [Deploy next generation protection](deploy-manage-report-windows-defender-antivirus.md) +- [Manage next generation protection updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) - [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) - [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) - [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md index 817e523825..eed53e37e7 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md @@ -30,7 +30,7 @@ There are two components to managing protection updates - where the updates are This topic describes where you can specify the updates should be downloaded from, also known as the fallback order. -See the [Manage Windows Defender AV updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates). +See [Manage next generation protection updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates). @@ -150,11 +150,11 @@ See the following for more information: ## Related topics -- [Deploy, manage updates, and report on Windows Defender AV](deploy-manage-report-windows-defender-antivirus.md) -- [Manage Windows Defender AV updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) -- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) + +- [Deploy next generation protection](deploy-manage-report-windows-defender-antivirus.md) +- [Manage next generation protection updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) - [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) - [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) - [Manage updates for mobile devices and VMs](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) -- [Windows Defender AV in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index 96f18fc71c..8d4723b237 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -14,9 +14,9 @@ ms.author: v-anbic ms.date: 04/30/2018 --- -# Manage Windows Defender Antivirus updates and apply baselines +# Manage next generation protection updates and apply baselines -There are two types of updates related to keeping Windows Defender Antivirus: +There are two types of updates related to keeping antivirus up to date: 1. Protection updates 2. Product updates @@ -24,14 +24,14 @@ You can also apply [Windows security baselines](https://technet.microsoft.com/en ## Protection updates -Windows Defender AV uses both [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloaded protection updates to provide protection. These protection updates are also known as "definitions" or "signature updates". +Antivirus uses both [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloaded protection updates to provide protection. These protection updates are also known as "definitions" or "signature updates". The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the protection updates generally occur once a day (although this can be configured). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection. ## Product updates -Windows Defender AV requires [monthly updates](https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform) (known as "engine updates" and "platform updates"), and will receive major feature updates alongside Windows 10 releases. +Next generation protection requires [monthly updates](https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform) (known as "engine updates" and "platform updates"), and will receive major feature updates alongside Windows 10 releases. You can manage the distribution of updates through Windows Server Update Service (WSUS), with [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network. diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md index cf9c23f821..056899b4a9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md @@ -37,7 +37,7 @@ The following topics may also be useful in these situations: ## Opt-in to Microsoft Update on mobile computers without a WSUS connection -You can use Microsoft Update to keep definitions on mobile devices running Windows Defender AV up to date when they are not connected to the corporate network or don't otherwise have a WSUS connection. +You can use Microsoft Update to keep definitions on mobile devices running antivirus up to date when they are not connected to the corporate network or don't otherwise have a WSUS connection. This means that protection updates can be delivered to devices (via Microsoft Update) even if you have set WSUS to override Microsoft Update. @@ -74,7 +74,7 @@ You can opt-in to Microsoft Update on the mobile device in one of the following ## Prevent definition updates when running on battery power -You can configure Windows Defender AV to only download protection updates when the PC is connected to a wired power source. +You can configure antivirus to only download protection updates when the PC is connected to a wired power source. **Use Group Policy to prevent definition updates on battery power:** @@ -95,5 +95,5 @@ You can configure Windows Defender AV to only download protection updates when t ## Related topics -- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) -- [Update and manage Windows Defender in Windows 10](deploy-manage-report-windows-defender-antivirus.md) +- [Manage next generationprotection updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) +- [Update and manage next generation protection in Windows 10](deploy-manage-report-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md index 1a1656a70c..f116e61e07 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md @@ -14,13 +14,13 @@ ms.author: v-anbic ms.date: 04/30/2018 --- -# Prevent users from seeing or interacting with the Windows Defender AV user interface +# Prevent users from seeing or interacting with the antivirus user interface -You can use Group Policy to prevent users on endpoints from seeing the Windows Defender Antivirus interface. You can also prevent them from pausing scans. +You can use Group Policy to prevent users on endpoints from seeing the antivirus interface. You can also prevent them from pausing scans. -## Hide the Windows Defender Antivirus interface +## Hide the antivirus interface -In Windows 10, versions 1703, hiding the interface will hide Windows Defender AV notifications and prevent the Virus & threat protection tile from appearing in the Windows Defender Security Center app. +In Windows 10, versions 1703, hiding the interface will hide antivirus notifications and prevent the Virus & threat protection tile from appearing in the Windows Defender Security Center app. With the setting set to **Enabled**: @@ -31,7 +31,7 @@ With the setting set to **Disabled** or not configured: ![Scheenshot of Windows Defender Security Center showing the shield icon and virus and threat protection section](images/defender/wdav-headless-mode-off-1703.png) >[!NOTE] ->Hiding the interface will also prevent Windows Defender AV notifications from appearing on the endpoint. Windows Defender Advanced Threat Protection notifications will still appear. You can also individually [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) +>Hiding the interface will also prevent antivirus notifications from appearing on the endpoint. Windows Defender Advanced Threat Protection notifications will still appear. You can also individually [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) In earlier versions of Windows 10, the setting will hide the Windows Defender client interface. If the user attempts to open it, they will receive a warning "Your system administrator has restricted access to this app.": @@ -76,4 +76,4 @@ You can prevent users from pausing scans. This can be helpful to ensure schedule - [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) - [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md index 2593dfcfbc..f90151a848 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md @@ -14,15 +14,15 @@ ms.author: v-anbic ms.date: 07/10/2018 --- -# Report on Windows Defender Antivirus protection +# Report on next generation protection -There are a number of ways you can review protection status and alerts, depending on the management tool you are using for Windows Defender AV. +There are a number of ways you can review protection status and alerts, depending on the management tool you are using for next generation protection. -You can use System Center Configuration Manager to [monitor Windows Defender AV protection](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-configure-alerts), or you can also monitor protection using [Microsoft Intune](https://docs.microsoft.com/en-us/intune/introduction-intune). +You can use System Center Configuration Manager to [monitor next generation protection](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-configure-alerts), or you can also monitor protection using [Microsoft Intune](https://docs.microsoft.com/en-us/intune/introduction-intune). -Microsoft Operations Management Suite has an [Update Compliance add-in](/windows/deployment/update/update-compliance-get-started) that reports on key Windows Defender AV issues, including protection updates and real-time protection settings. +Microsoft Operations Management Suite has an [Update Compliance add-in](/windows/deployment/update/update-compliance-get-started) that reports on key antivirus issues, including protection updates and real-time protection settings. If you have a third-party security information and event management (SIEM) tool, you can also consume [Windows Defender client events](https://msdn.microsoft.com/en-us/library/windows/desktop/aa964766(v=vs.85).aspx). @@ -37,5 +37,5 @@ For monitoring or determining status with PowerShell, WMI, or Microsoft Azure, s ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) -- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Deploy next generation protection](deploy-manage-report-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md index 98c30a78fa..f42c88a508 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md @@ -20,7 +20,7 @@ ms.date: 04/23/2018 - Windows Defender Security Center -If Windows Defender Antivirus is configured to detect and remediate threats on your device, Windows Defender AV quarantines suspicious files. If you are certain these files do not present a threat, you can restore them. +If next generation protection is configured to detect and remediate threats on your device, antivirus quarantines suspicious files. If you are certain these files do not present a threat, you can restore them. 1. Open **Windows Defender Security Center**. 2. Click **Virus & threat protection** and then click **Scan history**. @@ -33,5 +33,5 @@ If Windows Defender Antivirus is configured to detect and remediate threats on y - [Review scan results](review-scan-results-windows-defender-antivirus.md) - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) -- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) +- [Configure antivirus exclusions on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md index 92a0fd512b..b0a6a2792a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md @@ -14,26 +14,32 @@ ms.author: v-anbic ms.date: 07/10/2018 --- -# Review Windows Defender AV scan results +# Review antivirus scan results **Manageability available with** +- Microsoft Intune +- System Center Configuration Manager - PowerShell - Windows Management Instrumentation (WMI) -- System Center Configuration Manager -- Microsoft Intune - Windows Defender Security Center app -After Windows Defender Antivirus has completed a scan, whether it is an [on-demand](run-scan-windows-defender-antivirus.md) or [scheduled scan](scheduled-catch-up-scans-windows-defender-antivirus.md), the results are recorded and you can view the results. +After an antivirus scan completes, whether it is an [on-demand](run-scan-windows-defender-antivirus.md) or [scheduled scan](scheduled-catch-up-scans-windows-defender-antivirus.md), the results are recorded and you can view the results. -**Use Configuration Manager to review Windows Defender AV scan results:** +**Use Microsoft Intune to review scan results:** + +1. In Intune, go to **Devices > All Devices** and select the device you want to scan. + +2. Click the scan results in **Device actions status**. + +**Use Configuration Manager to review scan results:** See [How to monitor Endpoint Protection status](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection). -**Use the Windows Defender Security Center app to review Windows Defender AV scan results:** +**Use the Windows Defender Security Center app to review scan results:** 1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -45,7 +51,7 @@ See [How to monitor Endpoint Protection status](https://docs.microsoft.com/en-us -**Use PowerShell cmdlets to review Windows Defender AV scan results:** +**Use PowerShell cmdlets to review scan results:** The following cmdlet will return each detection on the endpoint. If there are multiple detections of the same threat, each detection will be listed separately, based on the time of each detection: @@ -67,20 +73,15 @@ Get-MpThreat See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. -**Use Windows Management Instruction (WMI) to review Windows Defender AV scan results:** +**Use Windows Management Instruction (WMI) to review scan results:** Use the [**Get** method of the **MSFT_MpThreat** and **MSFT_MpThreatDetection**](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) classes. -**Use Microsoft Intune to review Windows Defender AV scan results:** - -1. In Intune, go to **Devices > All Devices** and select the device you want to scan. - -2. Click the scan results in **Device actions status**. ## Related topics -- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file +- [Customize, initiate, and review the results of antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md index f2d0786031..26f2fdc335 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md @@ -14,15 +14,15 @@ ms.author: v-anbic ms.date: 07/10/2018 --- -# Configure and run on-demand Windows Defender AV scans +# Configure and run on-demand antivirus scans **Manageability available with** -- Windows Defender AV mpcmdrun utility +- Microsoft Intune +- System Center Configuration Manager - PowerShell - Windows Management Instrumentation (WMI) -- System Center Configuration Manager -- Microsoft Intune +- Mpcmdrun utility - Windows Defender Security Center app You can run an on-demand scan on individual endpoints. These scans will start immediately, and you can define parameters for the scan, such as the location or type. @@ -32,13 +32,17 @@ You can run an on-demand scan on individual endpoints. These scans will start im Quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders. -Combined with [always-on real-time protection capability](configure-real-time-protection-windows-defender-antivirus.md) - which reviews files when they are opened and closed, and whenever a user navigates to a folder - a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware. +Combined with [always-on real-time protection capability](configure-real-time-protection-windows-defender-antivirus.md)--which reviews files when they are opened and closed, and whenever a user navigates to a folder--a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware. In most instances, this means a quick scan is adequate to find malware that wasn't picked up by real-time protection. A full scan can be useful on endpoints that have encountered a malware threat to identify if there are any inactive components that require a more thorough clean-up, and can be ideal when running on-demand scans. +**Use Configuration Manager to run a scan:** + +See [Antimalware and firewall tasks: How to perform an on-demand scan](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-firewall#how-to-perform-an-on-demand-scan-of-computers) for details on using System Center Configuration Manager (current branch) to run a scan. + **Use the mpcmdrum.exe command-line utility to run a scan:** Use the following `-scan` parameter: @@ -53,10 +57,11 @@ See [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defen -**Use Configuration Manager to run a scan:** +**Use Microsoft Intune to run a scan:** -See [Antimalware and firewall tasks: How to perform an on-demand scan](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-firewall#how-to-perform-an-on-demand-scan-of-computers) for details on using System Center Configuration Manager (current branch) to run a scan. +1. In Intune, go to **Devices > All Devices** and select the device you want to scan. +2. Select **...More** and then select **Quick Scan** or **Full Scan**. **Use the Windows Defender Security Center app to run a scan:** @@ -84,16 +89,9 @@ See the following for more information and allowed parameters: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) -**Use Microsoft Intune to run a scan:** - -1. In Intune, go to **Devices > All Devices** and select the device you want to scan. - -2. Select **...More** and then select **Quick Scan** or **Full Scan**. - - ## Related topics -- [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) -- [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file +- [Configure antivirus scanning options](configure-advanced-scan-types-windows-defender-antivirus.md) +- [Configure scheduled antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md) +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md index 7763632674..cc9710fc3c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md @@ -14,9 +14,7 @@ ms.author: v-anbic ms.date: 07/26/2018 --- -# Configure scheduled quick or full scans for Windows Defender AV - -- Enterprise security administrators +# Configure scheduled quick or full antivirus scans **Manageability available with** @@ -28,7 +26,7 @@ ms.date: 07/26/2018 > [!NOTE] -> By default, Windows Defender AV will check for an update 15 minutes before the time of any scheduled scans. You can [Manage the schedule for when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) to override this default. +> By default, antivirus checks for an update 15 minutes before the time of any scheduled scans. You can [Manage the schedule for when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) to override this default. In addition to always-on real-time protection and [on-demand](run-scan-windows-defender-antivirus.md) scans, you can set up regular, scheduled scans. @@ -76,7 +74,7 @@ Location | Setting | Description | Default setting (if not configured) Scan | Specify the scan type to use for a scheduled scan | Quick scan Scan | Specify the day of the week to run a scheduled scan | Specify the day (or never) to run a scan. | Never Scan | Specify the time of day to run a scheduled scan | Specify the number of minutes after midnight (for example, enter **60** for 1 am). | 2 am -Root | Randomize scheduled task times | Randomize the start time of the scan to any interval from 0 to 4 hours, or to any interval plus or minus 30 minutes for non-Windows Defender scans. This can be useful in VM or VDI deployments. | Enabled +Root | Randomize scheduled task times | Randomize the start time of the scan to any interval from 0 to 4 hours, or to any interval plus or minus 30 minutes for non-Windows antivirus scans. This can be useful in VM or VDI deployments. | Enabled **Use PowerShell cmdlets to schedule scans:** @@ -231,8 +229,8 @@ Signature updates | Turn on scan after signature update | A scan will occur imme - [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) -- [Configure and run on-demand Windows Defender AV scans](run-scan-windows-defender-antivirus.md) -- [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) -- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) +- [Configure and run on-demand antivirus scans](run-scan-windows-defender-antivirus.md) +- [Configure antivirus scanning options](configure-advanced-scan-types-windows-defender-antivirus.md) +- [Manage antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) - [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md index b497ea1b52..12e6ec8761 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md @@ -22,34 +22,13 @@ ms.date: 07/19/2018 - System Center Configuration Manager (current branch) - Intune -You can specify the level of cloud-protection offered by Windows Defender Antivirus with Group Policy and System Center Configuration Manager. +You can specify the level of cloud-protection offered by antivirus with Group Policy and System Center Configuration Manager. >[!NOTE] ->The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional signature updates. +>The antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional signature updates. -**Use Group Policy to specify the level of cloud-delivered protection:** - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > MpEngine**. - -1. Double-click the **Select cloud protection level** setting and set it to **Enabled**. Select the level of protection: - 1. Setting to **Default Windows Defender Antivirus blocking level** will provide strong detection without increasing the risk of detecting legitimate files. - 2. Setting to **High blocking level** will apply a strong level of detection. While unlikely, some legitimate files may be detected (although you will have the option to unblock or dispute that detection). - -1. Click **OK**. - - -**Use Configuration Manager to specify the level of cloud-delivered protection:** - -1. See [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) for details on configuring System Center Configuration Manager (current branch). - **Use Intune to specify the level of cloud-delivered protection:** 1. Sign in to the [Azure portal](https://portal.azure.com). @@ -70,10 +49,32 @@ You can specify the level of cloud-protection offered by Windows Defender Antivi For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/en-us/intune/device-profiles) +**Use Configuration Manager to specify the level of cloud-delivered protection:** + +1. See [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) for details on configuring System Center Configuration Manager (current branch). + +**Use Group Policy to specify the level of cloud-delivered protection:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > MpEngine**. + +1. Double-click the **Select cloud protection level** setting and set it to **Enabled**. Select the level of protection: + 1. Setting to **Default Windows Defender Antivirus blocking level** will provide strong detection without increasing the risk of detecting legitimate files. + 2. Setting to **High blocking level** will apply a strong level of detection. While unlikely, some legitimate files may be detected (although you will have the option to unblock or dispute that detection). + +1. Click **OK**. + + + ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) - [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) - [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) diff --git a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md index a01cb86821..566d63a2e6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md +++ b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md @@ -14,16 +14,16 @@ ms.author: v-anbic ms.date: 04/30/2018 --- -# Troubleshoot Windows Defender Antivirus reporting in Update Compliance +# Troubleshoot antivirus reporting in Update Compliance -When you use [Windows Analytics Update Compliance to obtain reporting into the protection status of machines or endpoints](/windows/deployment/update/update-compliance-using#wdav-assessment) in your network that are using Windows Defender Antivirus, you may encounter problems or issues. +When you use [Windows Analytics Update Compliance to obtain reporting into the protection status of machines or endpoints](/windows/deployment/update/update-compliance-using#wdav-assessment) in your network that are using next generation protection, you may encounter problems or issues. Typically, the most common indicators of a problem are: - You only see a small number or subset of all the devices you were expecting to see - You do not see any devices at all - The reports and information you do see is outdated (older than a few days) -For common error codes and event IDs related to the Windows Defender AV service that are not related to Update Compliance, see the [Windows Defender Antivirus events](troubleshoot-windows-defender-antivirus.md) topic. +For common error codes and event IDs related to the antivirus service that are not related to Update Compliance, see [Antivirus events](troubleshoot-windows-defender-antivirus.md). There are three steps to troubleshooting these problems: @@ -32,12 +32,12 @@ There are three steps to troubleshooting these problems: 3. Submit support logs >[!IMPORTANT] ->It typically takes 3 days for devices to start appearing in Update Compliance +>It typically takes 3 days for devices to start appearing in Update Compliance. ## Confirm pre-requisites -In order for devices to properly show up in Update Compliance, you have to meet certain pre-requisites for both the Update Compliance service and for Windows Defender AV protection: +In order for devices to properly show up in Update Compliance, you have to meet certain pre-requisites for both the Update Compliance service and for next generation protection: >[!div class="checklist"] >- Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](windows-defender-antivirus-compatibility.md) and the endpoint will not be reported in Update Compliance. @@ -58,5 +58,5 @@ If the above pre-requisites have all been met, you may need to proceed to the ne ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) -- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) +- [Next generation protection in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Deploy next generation protection](deploy-manage-report-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md index 47304df20b..59c9c1532b 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md @@ -14,32 +14,33 @@ ms.author: v-anbic ms.date: 04/16/2018 --- -# Review event logs and error codes to troubleshoot issues with Windows Defender AV +# Review event logs and error codes to troubleshoot issues with antivirus -If you encounter a problem with Windows Defender Antivirus, you can search the tables in this topic to find a matching issue and potential solution. +If you encounter a problem with antivirus, you can search the tables in this topic to find a matching issue and potential solution. The tables list: -- [Windows Defender AV event IDs](#windows-defender-av-ids) (these apply to both Windows 10 and Windows Server 2016) -- [Windows Defender AV client error codes](#error-codes) -- [Internal Windows Defender AV client error codes (used by Microsoft during development and testing)](#internal-error-codes) +- [Antivirus event IDs](#windows-defender-av-ids) (these apply to both Windows 10 and Windows Server 2016) +- [Antivirus client error codes](#error-codes) +- [Internal antivirus client error codes (used by Microsoft during development and testing)](#internal-error-codes) >[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working: +>You can also visit the Windows Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working: + >- Cloud-delivered protection >- Fast learning (including Block at first sight) >- Potentially unwanted application blocking -## Windows Defender AV event IDs +## Antivirus event IDs -Windows Defender AV records event IDs in the Windows event log. +Antivirus records event IDs in the Windows event log. -You can directly view the event log, or if you have a third-party security information and event management (SIEM) tool, you can also consume [Windows Defender client event IDs](troubleshoot-windows-defender-antivirus.md#windows-defender-av-ids) to review specific events and errors from your endpoints. +You can directly view the event log, or if you have a third-party security information and event management (SIEM) tool, you can also consume [antivirus client event IDs](troubleshoot-windows-defender-antivirus.md#windows-defender-av-ids) to review specific events and errors from your endpoints. -The table in this section lists the main Windows Defender AV event IDs and, where possible, provides suggested solutions to fix or resolve the error. +The table in this section lists the main antivirus event IDs and, where possible, provides suggested solutions to fix or resolve the error. -**To view a Windows Defender AV event** +**To view an antivirus event** 1. Open **Event Viewer**. 2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender Antivirus**. @@ -320,7 +321,7 @@ Description of the error. User action: -The Windows Defender client encountered an error, and the current scan has stopped. The scan might fail due to a client-side issue. This event record includes the scan ID, type of scan (antivirus, antispyware, antimalware), scan parameters, the user that started the scan, the error code, and a description of the error. +The antivirus client encountered an error, and the current scan has stopped. The scan might fail due to a client-side issue. This event record includes the scan ID, type of scan (antivirus, antispyware, antimalware), scan parameters, the user that started the scan, the error code, and a description of the error. To troubleshoot this event:
  1. Run the scan again.
  2. @@ -428,7 +429,7 @@ Message: Description: -Windows Defender has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following: +Antivirus has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following:
    User: <Domain>\\<User>
    Name: <Threat name>
    @@ -480,7 +481,7 @@ Message: Description: -Windows Defender has encountered an error when taking action on malware or other potentially unwanted software. For more information please see the following: +Antivirus has encountered an error when taking action on malware or other potentially unwanted software. For more information please see the following:
    User: <Domain>\\<User>
    Name: <Threat name>
    @@ -539,7 +540,7 @@ Message: Description: -Windows Defender has restored an item from quarantine. For more information please see the following: +Antivirus has restored an item from quarantine. For more information please see the following:
    Name: <Threat name>
    ID: <Threat ID>
    @@ -583,7 +584,7 @@ Message: Description: -Windows Defender has encountered an error trying to restore an item from quarantine. For more information please see the following: +Antivirus has encountered an error trying to restore an item from quarantine. For more information please see the following:
    Name: <Threat name>
    ID: <Threat ID>
    @@ -630,7 +631,7 @@ Message: Description: -Windows Defender has deleted an item from quarantine. +Antivirus has deleted an item from quarantine. For more information please see the following:
    Name: <Threat name>
    @@ -674,7 +675,7 @@ Message: Description: -Windows Defender has encountered an error trying to delete an item from quarantine. +Antivirus has encountered an error trying to delete an item from quarantine. For more information please see the following:
    Name: <Threat name>
    @@ -722,7 +723,7 @@ Message: Description: -Windows Defender has removed history of malware and other potentially unwanted software. +Antivirus has removed history of malware and other potentially unwanted software.
    Time: The time when the event occurred, for example when the history is purged. Note that this parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
    User: <Domain>\\<User>
    @@ -753,7 +754,7 @@ The antimalware platform could not delete history of malware and other potential Description: -Windows Defender has encountered an error trying to remove history of malware and other potentially unwanted software. +Antivirus has encountered an error trying to remove history of malware and other potentially unwanted software.
    Time: The time when the event occurred, for example when the history is purged. Note that this parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
    User: <Domain>\\<User>
    @@ -788,7 +789,7 @@ Message: Description: -Windows Defender has detected a suspicious behavior. +Antivirus has detected a suspicious behavior. For more information please see the following:
    Name: <Threat name>
    @@ -866,7 +867,7 @@ Message: Description: -Windows Defender has detected malware or other potentially unwanted software. +Antivirus has detected malware or other potentially unwanted software. For more information please see the following:
    Name: <Threat name>
    @@ -920,7 +921,7 @@ UAC User action: -No action is required. Windows Defender can suspend and take routine action on this threat. If you want to remove the threat manually, in the Windows Defender interface, click Clean Computer. +No action is required. Antivirus can suspend and take routine action on this threat. If you want to remove the threat manually, in the antivirus interface, click Clean Computer. @@ -948,7 +949,7 @@ Message: Description: -Windows Defender has taken action to protect this machine from malware or other potentially unwanted software. +Antivirus has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following:
    Name: <Threat name>
    @@ -1010,7 +1011,7 @@ Description of the error.
    Signature Version: <Definition version>
    Engine Version: <Antimalware Engine version>
    NOTE: -Whenever Windows Defender, Microsoft Security Essentials, Malicious Software Removal Tool, or System Center Endpoint Protection detects a malware, it will restore the following system settings and services which the malware might have changed: