mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-22 22:03:46 +00:00
Merge remote-tracking branch 'refs/remotes/origin/jdh1wcd' into 19H1
This commit is contained in:
Jeanie Decker
@ -177,6 +177,9 @@ To disable Windows Defender Credential Guard, you can use the following set of p
|
||||
> [!NOTE]
|
||||
> The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Windows Defender Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
|
||||
|
||||
> [!NOTE]
|
||||
> Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. These options will be made available with future Gen 2 VMs.
|
||||
|
||||
For more info on virtualization-based security and Windows Defender Device Guard, see [Windows Defender Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide).
|
||||
|
||||
<span id="turn-off-with-hardware-readiness-tool" />
|
||||
|
||||
@ -39,7 +39,7 @@ To provide basic protections against OS level attempts to read Credential Manage
|
||||
The Virtualization-based security requires:
|
||||
- 64-bit CPU
|
||||
- CPU virtualization extensions plus extended page tables
|
||||
- Windows hypervisor
|
||||
- Windows hypervisor (does not require Hyper-V Windows Feature to be installed)
|
||||
|
||||
### Windows Defender Credential Guard deployment in virtual machines
|
||||
|
||||
|
||||
@ -131,9 +131,9 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv
|
||||
5. In the content pane, right-click the **NDES Service Rights** Group Policy object and click **Edit**.
|
||||
6. In the navigation pane, expand **Policies** under **Computer Configuration**.
|
||||
7. Expand **Windows Settings > Security Settings > Local Policies**. Select **User Rights Assignments**.
|
||||
8. In the content pane, double-click **Allow log on locally**. Select **Define these policy settings**. and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** twice.
|
||||
9. In the content pane, double-click **Log on as a batch job**. Select **Define these policy settings**. and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Performance Log Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** twice.
|
||||
10. In the content pane, double-click **Log on as a batch job**. Select **Define these policy settings**. and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **NT SERVICE\ALL SERVICES;DOMAINNAME\NDESSvc** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** three times.
|
||||
8. In the content pane, double-click **Allow log on locally**. Select **Define these policy settings** and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** twice.
|
||||
9. In the content pane, double-click **Log on as a batch job**. Select **Define these policy settings** and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Performance Log Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** twice.
|
||||
10. In the content pane, double-click **Log on as a service**. Select **Define these policy settings** and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **NT SERVICE\ALL SERVICES;DOMAINNAME\NDESSvc** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** three times.
|
||||
11. Close the **Group Policy Management Editor**.
|
||||
|
||||
### Configure security for the NDES Service User Rights Group Policy object
|
||||
|
||||
@ -30,7 +30,7 @@ Enterprises can use either a key or a certificate to provide single-sign on for
|
||||
|
||||
When using a key, the on-premises environment needs an adequate distribution of Windows Server 2016 domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more.
|
||||
|
||||
When using a certificate, the on-premises environment can use Windows Server 2008 R2 and later domain controllers, which removes the Windows Server 2016 domain controller requirement. However, single-sign on using a key requires additional infrastructure to issue a certificate when the user enrolls for Windows Hello for Business. Azure AD joined devices enroll certificates using Microsoft Intune or a compatible Mobile Device Management (MDM). Microsoft Intune and Windows Hello for Business use the Network Device Enrollment Services (NDES) role and support Microsoft Intune connector.
|
||||
When using a certificate, the on-premises environment can use Windows Server 2008 R2 and later domain controllers, which removes the Windows Server 2016 domain controller requirement. However, single-sign on using a certificate requires additional infrastructure to issue a certificate when the user enrolls for Windows Hello for Business. Azure AD joined devices enroll certificates using Microsoft Intune or a compatible Mobile Device Management (MDM). Microsoft Intune and Windows Hello for Business use the Network Device Enrollment Services (NDES) role and support Microsoft Intune connector.
|
||||
|
||||
To deploy single sign-on for Azure AD joined devices using keys, read and follow [Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business](hello-hybrid-aadj-sso-base.md).
|
||||
To deploy single sign-on for Azure AD joined devices using certificates, read and follow [Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business](hello-hybrid-aadj-sso-base.md) and then [Using Certificates for AADJ On-premises Single-sign On](hello-hybrid-aadj-sso-cert.md).
|
||||
|
||||
@ -75,9 +75,9 @@ It’s fundamentally important to understand which deployment model to use for a
|
||||
|
||||
A deployment's trust type defines how each Windows Hello for Business client authenticates to the on-premises Active Directory. There are two trust types: key trust and certificate trust.
|
||||
|
||||
The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during an in-box provisioning experience, which requires an adequate distribution of Windows Server 2016 domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more.
|
||||
The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during the built-in provisioning experience. This requires an adequate distribution of Windows Server 2016 domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more.
|
||||
|
||||
The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the in-box provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers. Users can authenticate using their certificate to any Windows Server 2008 R2 or later domain controller.
|
||||
The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers. Users can authenticate using their certificate to any Windows Server 2008 R2 or later domain controller.
|
||||
|
||||
#### Device registration
|
||||
|
||||
@ -85,11 +85,11 @@ All devices included in the Windows Hello for Business deployment must go throug
|
||||
|
||||
#### Key registration
|
||||
|
||||
The in-box Windows Hello for Business provisioning experience creates a hardware bound asymmetric key pair as their user’s credentials. The private key is protected by the device’s security modules; however, the credential is a user key (not a device key). The provisioning experience registers the user’s public key with the identity provider. For cloud only and hybrid deployments, the identity provider is Azure Active Directory. For on-premises deployments, the identity provider is the on-premises server running Windows Server 2016 Active Directory Federation Services (AD FS) role.
|
||||
The built-in Windows Hello for Business provisioning experience creates a hardware bound asymmetric key pair as their user’s credentials. The private key is protected by the device’s security modules; however, the credential is a user key (not a device key). The provisioning experience registers the user’s public key with the identity provider. For cloud only and hybrid deployments, the identity provider is Azure Active Directory. For on-premises deployments, the identity provider is the on-premises server running Windows Server 2016 Active Directory Federation Services (AD FS) role.
|
||||
|
||||
#### Multifactor authentication
|
||||
|
||||
The goal of Windows Hello for Business is to move organizations away from passwords by providing them a strong credential that provides easy two-factor authentication. The in-box provisioning experience accepts the user’s weak credentials (username and password) as the first factor authentication; however, the user must provide a second factor of authentication before Windows provisions a strong credential.
|
||||
The goal of Windows Hello for Business is to move organizations away from passwords by providing them a strong credential that provides easy two-factor authentication. The built-in provisioning experience accepts the user’s weak credentials (username and password) as the first factor authentication; however, the user must provide a second factor of authentication before Windows provisions a strong credential.
|
||||
|
||||
Cloud only and hybrid deployments provide many choices for multi-factor authentication. On-premises deployments must use a multi-factor authentication that provides an AD FS multi-factor adapter to be used in conjunction with the on-premises Windows Server 2016 AD FS server role. Organizations can use the on-premises Azure Multi-factor Authentication server, or choose from several third parties (Read [Microsoft and third-party additional authentication methods](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods) for more information).
|
||||
>[!NOTE]
|
||||
@ -105,7 +105,7 @@ Cloud only and hybrid deployments provide many choices for multi-factor authenti
|
||||
|
||||
#### Directory synchronization
|
||||
|
||||
Hybrid and on-premises deployments use directory synchronization, however, each for a different purpose. Hybrid deployments use Azure Active Directory Connect to synchronize Active Directory identities or credentials between itself and Azure Active Directory. This helps enable single sign-on to Azure Active Directory and its federated components.
|
||||
Hybrid and on-premises deployments use directory synchronization, however, each for a different purpose. Hybrid deployments use Azure Active Directory Connect to synchronize Active Directory identities or credentials between itself and Azure Active Directory. This helps enable single sign-on to Azure Active Directory and its federated components. On-premises deployments use directory synchronization to import users from Active Directory to the Azure MFA Server, which sends data to the Azure MFA cloud service to perform the verification.
|
||||
|
||||
### Management
|
||||
|
||||
|
||||
@ -13,7 +13,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.date: 04/02/2019
|
||||
---
|
||||
|
||||
# BitLocker Group Policy settings
|
||||
@ -1167,7 +1167,8 @@ This policy controls how BitLocker reacts to systems that are equipped with encr
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><strong>When not configured</strong></p></td>
|
||||
<td align="left"><p>BitLocker uses hardware-based encryption with the encryption algorithm that is set for the drive. If hardware-based encryption is not available, BitLocker software-based encryption is used instead.</p></td>
|
||||
<td align="left"><p>BitLocker software-based encryption is used irrespective of hardware-based encryption ability.
|
||||
</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
@ -1221,7 +1222,7 @@ This policy controls how BitLocker reacts when encrypted drives are used as oper
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><strong>When not configured</strong></p></td>
|
||||
<td align="left"><p>BitLocker uses hardware-based encryption with the encryption algorithm that is set for the drive. If hardware-based encryption is not available, BitLocker software-based encryption is used instead.</p></td>
|
||||
<td align="left"><p>BitLocker software-based encryption is used irrespective of hardware-based encryption ability. </p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
@ -1277,7 +1278,7 @@ This policy controls how BitLocker reacts to encrypted drives when they are used
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><strong>When not configured</strong></p></td>
|
||||
<td align="left"><p>BitLocker uses hardware-based encryption with the encryption algorithm that is set for the drive. If hardware-based encryption is not available, BitLocker software-based encryption is used instead.</p></td>
|
||||
<td align="left"><p>BitLocker software-based encryption is used irrespective of hardware-based encryption ability. </p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
@ -7,28 +7,28 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
ms.date: 04/19/2017
|
||||
ms.topic: article
|
||||
ms.date: 04/02/2019
|
||||
---
|
||||
|
||||
# Encrypted Hard Drive
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2019
|
||||
- Windows Server 2016
|
||||
|
||||
Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.
|
||||
|
||||
By offloading the cryptographic operations to hardware, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. Because Encrypted Hard Drives encrypt data quickly, enterprise devices can expand BitLocker deployment with minimal impact on productivity.
|
||||
|
||||
Encrypted Hard Drives are a new class of hard drives that are self-encrypting at a hardware level and allow for full disk hardware encryption. In Windows 8, Windows Server 2012, and later you can install to these devices without additional modification.
|
||||
Encrypted Hard Drives are a new class of hard drives that are self-encrypting at a hardware level and allow for full disk hardware encryption. You can install Windows to Encrypted Hard Drives without additional modification beginning with Windows 8 and Windows Server 2012.
|
||||
|
||||
Some of the benefits of Encrypted Hard Drives include:
|
||||
Encrypted Hard Drives provide:
|
||||
|
||||
- **Better performance**: Encryption hardware, integrated into the drive controller, allows the drive to operate at full data rate with no performance degradation.
|
||||
- **Strong security based in hardware**: Encryption is always "on" and the keys for encryption never leave the hard drive. User authentication is performed by the drive before it will unlock, independently of the operating system
|
||||
- **Ease of use**: Encryption is transparent to the user because it is on by default. There is no user interaction needed to enable encryption. Encrypted Hard Drives are easily erased using on-board encryption key; there is no need to re-encrypt data on the drive.
|
||||
- **Lower cost of ownership**: There is no need for new infrastructure to manage encryption keys, since BitLocker leverages your Active Directory Domain Services infrastructure to store recovery information. Your device operates more efficiently because processor cycles do not need to be used for the encryption process.
|
||||
- **Ease of use**: Encryption is transparent to the user, and the user doesn't need to enable it. Encrypted Hard Drives are easily erased using on-board encryption key; there is no need to re-encrypt data on the drive.
|
||||
- **Lower cost of ownership**: There is no need for new infrastructure to manage encryption keys, since BitLocker leverages your existing infrastructure to store recovery information. Your device operates more efficiently because processor cycles do not need to be used for the encryption process.
|
||||
|
||||
Encrypted Hard Drives are supported natively in the operating system through the following mechanisms:
|
||||
|
||||
@ -38,20 +38,21 @@ Encrypted Hard Drives are supported natively in the operating system through the
|
||||
- **API**: API support for applications to manage Encrypted Hard Drives independently of BitLocker Drive Encryption (BDE)
|
||||
- **BitLocker support**: Integration with the BitLocker Control Panel provides a seamless BitLocker end user experience.
|
||||
|
||||
>**Warning:** Self-Encrypting Hard Drives and Encrypted Hard Drives for Windows are not the same type of device. Encrypted Hard Drives for Windows require compliance for specific TCG protocols as well as IEEE 1667 compliance; Self-Encrypting Hard Drives do not have these requirements. It is important to confirm the device type is an Encrypted Hard Drive for Windows when planning for deployment.
|
||||
>[!WARNING]
|
||||
>Self-Encrypting Hard Drives and Encrypted Hard Drives for Windows are not the same type of device. Encrypted Hard Drives for Windows require compliance for specific TCG protocols as well as IEEE 1667 compliance; Self-Encrypting Hard Drives do not have these requirements. It is important to confirm the device type is an Encrypted Hard Drive for Windows when planning for deployment.
|
||||
|
||||
If you are a storage device vendor who is looking for more info on how to implement Encrypted Hard Drive, see the [Encrypted Hard Drive Device Guide](https://msdn.microsoft.com/library/windows/hardware/dn653989.aspx).
|
||||
|
||||
## System Requirements
|
||||
|
||||
To use Encrypted Hard Drive, the following system requirements apply:
|
||||
To use Encrypted Hard Drives, the following system requirements apply:
|
||||
|
||||
For Encrypted Hard Drives used as **data drives**:
|
||||
For an Encrypted Hard Drive used as a **data drive**:
|
||||
|
||||
- The drive must be in an uninitialized state.
|
||||
- The drive must be in a security inactive state.
|
||||
|
||||
For Encrypted Hard Drives used as **startup drives**:
|
||||
For an Encrypted Hard Drive used as a **startup drive**:
|
||||
|
||||
- The drive must be in an uninitialized state.
|
||||
- The drive must be in a security inactive state.
|
||||
@ -59,7 +60,8 @@ For Encrypted Hard Drives used as **startup drives**:
|
||||
- The computer must have the Compatibility Support Module (CSM) disabled in UEFI.
|
||||
- The computer must always boot natively from UEFI.
|
||||
|
||||
>**Warning:** All Encrypted Hard Drives must be attached to non-RAID controllers to function properly.
|
||||
>[!WARNING]
|
||||
>All Encrypted Hard Drives must be attached to non-RAID controllers to function properly.
|
||||
|
||||
## Technical overview
|
||||
|
||||
@ -74,7 +76,15 @@ Configuration of Encrypted Hard Drives as startup drives is done using the same
|
||||
- **Deploy from server**: This deployment method involves PXE booting a client with Encrypted Hard Drives present. Configuration of Encrypted Hard Drives happens automatically in this environment when the Enhanced Storage component is added to the PXE boot image. During deployment, the [TCGSecurityActivationDisabled](https://msdn.microsoft.com/library/windows/hardware/dn923247.aspx) setting in unattend.xml controls the encryption behavior of Encrypted Hard Drives.
|
||||
- **Disk Duplication**: This deployment method involves use of a previously configured device and disk duplication tools to apply a Windows image to an Encrypted Hard Drive. Disks must be partitioned using at least Windows 8 or Windows Server 2012 for this configuration to work. Images made using disk duplicators will not work.
|
||||
|
||||
### Encrypted Hard Drive Architecture
|
||||
## Configuring hardware-based encryption with Group Policy
|
||||
|
||||
There are three related Group Policy settings that help you manage how BitLocker uses hardware-based envryption and which encryption algorithms to use. If these settings are not configured or disabled on systems that are equipped with encrypted drives, BitLocker uses software-based encryption:
|
||||
|
||||
- [Configure use of hardware-based encryption for fixed data drives](bitlocker/bitlocker-group-policy-settings.md#a-href-idbkmk-hdefxdaconfigure-use-of-hardware-based-encryption-for-fixed-data-drives)
|
||||
- [Configure use of hardware-based encryption for removable data drives](bitlocker/bitlocker-group-policy-settings.md#a-href-idbkmk-hderddaconfigure-use-of-hardware-based-encryption-for-removable-data-drives)
|
||||
- [Configure use of hardware-based encryption for operating system drives](bitlocker/bitlocker-group-policy-settings.md#a-href-idbkmk-hdeosdaconfigure-use-of-hardware-based-encryption-for-operating-system-drives)
|
||||
|
||||
## Encrypted Hard Drive Architecture
|
||||
|
||||
Encrypted Hard Drives utilize two encryption keys on the device to control the locking and unlocking of data on the drive. These are the Data Encryption Key (DEK) and the Authentication Key (AK).
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/26/2019
|
||||
ms.date: 04/05/2019
|
||||
---
|
||||
|
||||
# Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager
|
||||
@ -95,7 +95,7 @@ If you don't know the publisher or product name, you can find them for both desk
|
||||
|
||||
**To find the Publisher and Product Name values for Store apps without installing them**
|
||||
|
||||
1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, Microsoft OneNote.
|
||||
1. Go to the [Microsoft Store for Business](https://businessstore.microsoft.com/store) website, and find your app. For example, Microsoft OneNote.
|
||||
|
||||
>[!NOTE]
|
||||
|
||||
@ -505,16 +505,11 @@ After you've finished configuring your policy, you can review all of your info o
|
||||
After you’ve created your WIP policy, you'll need to deploy it to your organization's devices. For info about your deployment options, see these topics:
|
||||
- [Operations and Maintenance for Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708224)
|
||||
|
||||
- [How to Create Configuration Baselines for Compliance Settings in Configuration Manager]( https://go.microsoft.com/fwlink/p/?LinkId=708225)
|
||||
- [How to Create Configuration Baselines for Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708225)
|
||||
|
||||
- [How to Deploy Configuration Baselines in Configuration Manager]( https://go.microsoft.com/fwlink/p/?LinkId=708226)
|
||||
- [How to Deploy Configuration Baselines in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708226)
|
||||
|
||||
## Related topics
|
||||
- [System Center Configuration Manager and Endpoint Protection (Version 1606)](https://go.microsoft.com/fwlink/p/?LinkId=717372)
|
||||
|
||||
- [TechNet documentation for Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=691623)
|
||||
|
||||
- [Manage mobile devices with Configuration Manager and Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=691624)
|
||||
|
||||
- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md)
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 03/06/2019
|
||||
ms.date: 04/05/2019
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
@ -124,7 +124,16 @@ This table provides info about the most common problems you might encounter whil
|
||||
<td>If all apps need to be managed, enroll the device for MDM.
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>By design, files in the Windows directory (%windir% or C:/Windows) cannot be encrypted because they need to be accessed by any user. If a file in the Windows directory gets encypted by one user, other users can't access it.
|
||||
</td>
|
||||
<td>Any attempt to encrypt a file in the Windows directory will return a file access denied error. But if you copy or drag and drop an encrypted file to the Windows directory, it will retain encryption to honor the intent of the owner.
|
||||
</td>
|
||||
<td>If you need to save an encrypted file in the Windows directory, create and encrypt the file in a different directory and copy it.
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to our content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
|
||||
|
||||
@ -343,6 +343,7 @@
|
||||
##### Reporting
|
||||
###### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
###### [Threat protection reports](windows-defender-atp/threat-protection-reports-windows-defender-advanced-threat-protection.md)
|
||||
###### [Machine health and compliance reports](windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
##### Role-based access control
|
||||
###### [Manage portal access using RBAC](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: none
|
||||
author: Mir0sh
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 04/04/2019
|
||||
---
|
||||
|
||||
# 4716(S): Trusted domain information was modified.
|
||||
@ -132,7 +132,7 @@ This event is generated only on domain controllers.
|
||||
| 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.<br>Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 operating system.<br>Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. |
|
||||
| 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/library/cc223991.aspx).<br>Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.<br>Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. |
|
||||
| 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.<br>Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. |
|
||||
| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are more stringently [filtered](https://msdn.microsoft.com/library/cc223126.aspx#gt_ffbe7b55-8e84-4f41-a18d-fc29191a4cda) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/library/cc237917.aspx) section 4.1.2.2.<br>Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.<br>Only evaluated if SID Filtering is used.<br>Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.<br>Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. |
|
||||
| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are [more stringently filtered](https://docs.microsoft.com/openspecs/windows_protocols/ms-adts/e9a2d23c-c31e-4a6f-88a0-6646fdb51a3c) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/library/cc237917.aspx) section 4.1.2.2.<br>Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.<br>Only evaluated if SID Filtering is used.<br>Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.<br>Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. |
|
||||
| 0x80 | TRUST\_ATTRIBUTE\_USES\_RC4\_ENCRYPTION | This bit is set on trusts with the [trustType](https://msdn.microsoft.com/library/cc220955.aspx) set to TRUST\_TYPE\_MIT, which are capable of using RC4 keys. Historically, MIT Kerberos distributions supported only DES and 3DES keys ([\[RFC4120\]](https://go.microsoft.com/fwlink/?LinkId=90458), [\[RFC3961\]](https://go.microsoft.com/fwlink/?LinkId=90450)). MIT 1.4.1 adopted the RC4HMAC encryption type common to Windows 2000 [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx), so trusted domains deploying later versions of the MIT distribution required this bit. For more information, see "Keys and Trusts", section [6.1.6.9.1](https://msdn.microsoft.com/library/cc223782.aspx).<br>Only evaluated on TRUST\_TYPE\_MIT |
|
||||
| 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) section 3.3.5.7.5.<br>Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. |
|
||||
| 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/library/cc237917.aspx) section 4.1.2.2.<br>Evaluated only on Windows Server 2016<br>Evaluated only if SID Filtering is used.<br>Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.<br>Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. |
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
# Coin miners
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
|
||||
# How Microsoft identifies malware and potentially unwanted applications
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
# Exploits and exploit kits
|
||||
|
||||
|
||||
@ -12,11 +12,12 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
|
||||
# Fileless threats
|
||||
|
||||
What exactly is a fileless threat? The term "fileless" suggests that a threat that does not come in a file, such as a backdoor that lives only in the memory of a machine. However, there's no generally accepted definition. The terms is used broadly; it's also used to describe malware families that do rely on files in order to operate.
|
||||
What exactly is a fileless threat? The term "fileless" suggests that a threat that does not come in a file, such as a backdoor that lives only in the memory of a machine. However, there's no generally accepted definition. The terms is used broadly; it's also used to describe malware families that do rely on files in order to operate.
|
||||
|
||||
Given that attacks involve [several stages](https://attack.mitre.org/wiki/ATT&CK_Matrix) for functionalities like execution, persistence, information theft, lateral movement, communication with command-and-control, etc., some parts of the attack chain may be fileless, while others may involve the filesystem in some form or another.
|
||||
|
||||
@ -25,13 +26,13 @@ To shed light on this loaded term, we grouped fileless threats into different ca
|
||||
<br>
|
||||
*Figure 1. Comprehensive diagram of fileless malware*
|
||||
|
||||
We can classify fileless threats by their entry point, which indicates how fileless malware can arrive on a machine: via an exploit; through compromised hardware; or via regular execution of applications and scripts.
|
||||
We can classify fileless threats by their entry point, which indicates how fileless malware can arrive on a machine: via an exploit; through compromised hardware; or via regular execution of applications and scripts.
|
||||
|
||||
Next, we can list the form of entry point: for example, exploits can be based on files or network data; PCI peripherals are a type of hardware vector; and scripts and executables are sub-categories of the execution vector.
|
||||
|
||||
Finally, we can classify the host of the infection: for example, a Flash application that may contain an exploit; a simple executable; a malicious firmware from a hardware device; or an infected MBR, which could bootstrap the execution of a malware before the operating system even loads.
|
||||
|
||||
This helps us divide and categorize the various kinds of fileless threats. Clearly, the categories are not all the same: some are more dangerous but also more difficult to implement, while others are more commonly used despite (or precisely because of) not being very advanced.
|
||||
This helps us divide and categorize the various kinds of fileless threats. Clearly, the categories are not all the same: some are more dangerous but also more difficult to implement, while others are more commonly used despite (or precisely because of) not being very advanced.
|
||||
|
||||
From this categorization, we can glean three big types of fileless threats based on how much fingerprint they may leave on infected machines.
|
||||
|
||||
@ -39,7 +40,7 @@ From this categorization, we can glean three big types of fileless threats based
|
||||
|
||||
A completely fileless malware can be considered one that never requires writing a file on the disk. How would such malware infect a machine in the first place? An example scenario could be a target machine receiving malicious network packets that exploit the EternalBlue vulnerability, leading to the installation of the DoublePulsar backdoor, which ends up residing only in the kernel memory. In this case, there is no file or any data written on a file.
|
||||
|
||||
Another scenario could involve compromised devices, where malicious code could be hiding in device firmware (such as a BIOS), a USB peripheral (like the BadUSB attack), or even in the firmware of a network card. All these examples do not require a file on the disk in order to run and can theoretically live only in memory, surviving even reboots, disk reformats, and OS reinstalls.
|
||||
Another scenario could involve compromised devices, where malicious code could be hiding in device firmware (such as a BIOS), a USB peripheral (like the BadUSB attack), or even in the firmware of a network card. All these examples do not require a file on the disk in order to run and can theoretically live only in memory, surviving even reboots, disk reformats, and OS reinstalls.
|
||||
|
||||
Infections of this type can be extra difficult to detect and remediate. Antivirus products usually don’t have the capability to access firmware for inspection; even if they did, it would be extremely challenging to detect and remediate threats at this level. Because this type of fileless malware requires high levels of sophistication and often depend on particular hardware or software configuration, it’s not an attack vector that can be exploited easily and reliably. For this reason, while extremely dangerous, threats of this type tend to be very uncommon and not practical for most attacks.
|
||||
|
||||
@ -68,7 +69,7 @@ Having described the broad categories, we can now dig into the details and provi
|
||||
|
||||
**File-based** (Type III: executable, Flash, Java, documents): An initial file may exploit the operating system, the browser, the Java engine, the Flash engine, etc. in order to execute a shellcode and deliver a payload in memory. While the payload is fileless, the initial entry vector is a file.
|
||||
|
||||
**Network-based** (Type I): A network communication that takes advantage of a vulnerability in the target machine can achieve code execution in the context of an application or the kernel. An example is WannaCry, which exploits a previously fixed vulnerability in the SMB protocol to deliver a backdoor within the kernel memory.
|
||||
**Network-based** (Type I): A network communication that takes advantage of a vulnerability in the target machine can achieve code execution in the context of an application or the kernel. An example is WannaCry, which exploits a previously fixed vulnerability in the SMB protocol to deliver a backdoor within the kernel memory.
|
||||
|
||||
### Hardware
|
||||
|
||||
@ -76,9 +77,9 @@ Having described the broad categories, we can now dig into the details and provi
|
||||
|
||||
**CPU-based** (Type I): Modern CPUs are extremely complex and may include subsystems running firmware for management purposes. Such firmware may be vulnerable to hijacking and allow the execution of malicious code that would hence operate from within the CPU. In December 2017, two researchers reported a vulnerability that can allow attackers to execute code inside the [Management Engine (ME)](https://en.wikipedia.org/wiki/Intel_Management_Engine) present in any modern CPU from Intel. Meanwhile, the attacker group PLATINUM has been observed to have the capability to use Intel's [Active Management Technology (AMT)](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology) to perform [invisible network communications](https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/) bypassing the installed operating system. ME and AMT are essentially autonomous micro-computers that live inside the CPU and that operate at a very low level. Because these technologies’ purpose is to provide remote manageability, they have direct access to hardware, are independent of the operating system, and can run even if the computer is turned off. Besides being vulnerable at the firmware level, CPUs could be manufactured with backdoors inserted directly in the hardware circuitry. This attack has been [researched and proved possible](https://www.emsec.rub.de/media/crypto/veroeffentlichungen/2015/03/19/beckerStealthyExtended.pdf) in the past. Just recently it has been reported that certain models of x86 processors contain a secondary embedded RISC-like CPU core that can [effectively provide a backdoor](https://www.theregister.co.uk/2018/08/10/via_c3_x86_processor_backdoor/) through which regular applications can gain privileged execution.
|
||||
|
||||
**USB-based** (Type I): USB devices of all kinds can be reprogrammed with a malicious firmware capable of interacting with the operating system in nefarious ways. This is the case of the [BadUSB technique](https://arstechnica.com/information-technology/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/), demonstrated few years ago, which allows a reprogrammed USB stick to act as a keyboard that sends commands to machines via keystrokes, or as a network card that can redirect traffic at will.
|
||||
**USB-based** (Type I): USB devices of all kinds can be reprogrammed with a malicious firmware capable of interacting with the operating system in nefarious ways. This is the case of the [BadUSB technique](https://arstechnica.com/information-technology/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/), demonstrated few years ago, which allows a reprogrammed USB stick to act as a keyboard that sends commands to machines via keystrokes, or as a network card that can redirect traffic at will.
|
||||
|
||||
**BIOS-based** (Type I): A BIOS is a firmware running inside a chipset. It executes when a machine is powered on, initializes the hardware, and then transfers control to the boot sector. It’s a very important component that operates at a very low level and executes before the boot sector. It’s possible to reprogram the BIOS firmware with malicious code, as has happened in the past with the [Mebromi rootkit](https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/).
|
||||
**BIOS-based** (Type I): A BIOS is a firmware running inside a chipset. It executes when a machine is powered on, initializes the hardware, and then transfers control to the boot sector. It’s a very important component that operates at a very low level and executes before the boot sector. It’s possible to reprogram the BIOS firmware with malicious code, as has happened in the past with the [Mebromi rootkit](https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/).
|
||||
|
||||
**Hypervisor-based** (Type I): Modern CPUs provide hardware hypervisor support, allowing the operating system to create robust virtual machines. A virtual machine runs in a confined, simulated environment, and is in theory unaware of the emulation. A malware taking over a machine may implement a small hypervisor in order to hide itself outside of the realm of the running operating system. Malware of this kind has been theorized in the past, and eventually real hypervisor rootkits [have been observed](http://seclists.org/fulldisclosure/2017/Jun/29), although very few are known to date.
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
# Macro malware
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
# Malware names
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
|
||||
# Phishing
|
||||
@ -83,6 +84,7 @@ Enterprises should educate and train their employees to be wary of any communica
|
||||
Here are several telltale signs of a phishing scam:
|
||||
|
||||
* The links or URLs provided in emails are **not pointing to the correct location** or are attempting to have you access a third-party site that is not affiliated with the sender of the email. For example, in the image below the URL provided does not match the URL that you will be taken to.
|
||||
|
||||
|
||||
|
||||
* There is a **request for personal information** such as social security numbers or bank or financial information. Official communications won't generally request personal information from you in the form of an email.
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
# Prevent malware infection
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
# Ransomware
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
# Rootkits
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
# Microsoft Safety Scanner
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
|
||||
# Submit files for analysis
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
|
||||
# Supply chain attacks
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
# Tech support scams
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
|
||||
# Top scoring in industry tests
|
||||
@ -40,9 +41,13 @@ Windows Defender Antivirus is part of the [next generation](https://www.youtub
|
||||
|
||||
The AV-TEST Product Review and Certification Report tests on three categories: protection, performance, and usability. The scores listed below are for the Protection category which has two scores: Real-World Testing and the AV-TEST reference set (known as "Prevalent Malware").
|
||||
|
||||
- November - December 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/december-2018/microsoft-windows-defender-antivirus-4.18-185074/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWusR9) <sup>**Latest**</sup>
|
||||
- January - February 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/february-2019/microsoft-windows-defender-antivirus-4.18-190611/) <sup>**Latest**</sup>
|
||||
|
||||
Windows Defender Antivirus achieved an overall Protection score of 6.0/6.0, detecting 100% of 19,956 malware samples. This is the fourth consecutive cycle that Windows Defender Antivirus achieved a perfect score.
|
||||
Windows Defender Antivirus achieved an overall Protection score of 6.0/6.0, with 19,956 malware samples used. This is the fifth consecutive cycle that Windows Defender Antivirus achieved a perfect score.
|
||||
|
||||
- November - December 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/december-2018/microsoft-windows-defender-antivirus-4.18-185074/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWusR9)
|
||||
|
||||
Windows Defender Antivirus achieved an overall Protection score of 6.0/6.0, detecting 100% of 19,956 malware samples.
|
||||
|
||||
- September - October 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/october-2018/microsoft-windows-defender-antivirus-4.18-184174/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWqOqD)
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
|
||||
# Trojans
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
search.appverid: met150
|
||||
---
|
||||
# Understanding malware & other threats
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
# Unwanted software
|
||||
|
||||
|
||||
@ -12,6 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
|
||||
# Worms
|
||||
|
||||
@ -12,7 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 04/01/2019
|
||||
---
|
||||
|
||||
# Audit: Audit the use of Backup and Restore privilege
|
||||
@ -80,7 +80,7 @@ When the backup and restore function is used, it creates a copy of the file syst
|
||||
### Countermeasure
|
||||
|
||||
Enable the **Audit: Audit the use of Backup and Restore privilege** setting. Alternatively, implement automatic log backup by configuring the **AutoBackupLogFiles** registry key. If you enable this option when the [Audit privilege use](../auditing/basic-audit-privilege-use.md) setting is also enabled, an audit event is generated for every file that is backed up or restored. This information could help you to identify an account that was used to accidentally or maliciously restore data in an unauthorized manner.
|
||||
For more information about configuring this key, see Microsoft Knowledge Base article [100879](https://go.microsoft.com/fwlink/p/?LinkId=100879).
|
||||
For more information about configuring this key, see [Eventlog Key](https://docs.microsoft.com/windows/desktop/EventLog/eventlog-key).
|
||||
|
||||
### Potential impact
|
||||
|
||||
|
||||
@ -34,37 +34,34 @@ You should also have access to Windows Defender Security Center.
|
||||
Microsoft Defender ATP for Mac system requirements:
|
||||
- macOS version: 10.14 (Mojave), 10.13 (High Sierra), 10.12 (Sierra)
|
||||
- Disk space during preview: 1GB
|
||||
- The following URLs must be accessible from the Mac device:
|
||||
- ```https://cdn.x.cp.wd.microsoft.com/ ```<br>
|
||||
- ```https://eu-cdn.x.cp.wd.microsoft.com/ ```<br>
|
||||
- ```https://wu-cdn.x.cp.wd.microsoft.com/ ``` <br>
|
||||
- ```https://x.cp.wd.microsoft.com/ ``` <br>
|
||||
- ```https://asia.x.cp.wd.microsoft.com/ ``` <br>
|
||||
- ```https://australia.x.cp.wd.microsoft.com/ ``` <br>
|
||||
- ```https://europe.x.cp.wd.microsoft.com/ ``` <br>
|
||||
- ```https://unitedkingdom.x.cp.wd.microsoft.com/ ``` <br>
|
||||
- ```https://unitedstates.x.cp.wd.microsoft.com/ ``` <br>
|
||||
|
||||
After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints.
|
||||
|
||||
The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an **allow** rule specifically for them:
|
||||
|
||||
| Service | Description | URL |
|
||||
| -------------- |:------------------------------------:| --------------------------------------------------------------------:|
|
||||
| ATP | Advanced threat protection service | `https://x.cp.wd.microsoft.com/`, `https://*.x.cp.wd.microsoft.com/` |
|
||||
|
||||
To test that a connection is not blocked, open `https://x.cp.wd.microsoft.com/api/report` and `https://wu-cdn.x.cp.wd.microsoft.com/` in a browser, or run the following command in Terminal:
|
||||
|
||||
```
|
||||
mavel-mojave:~ testuser$ curl 'https://x.cp.wd.microsoft.com/api/report'
|
||||
OK
|
||||
```
|
||||
|
||||
We recommend to keep [System Integrity Protection](https://support.apple.com/en-us/HT204899) ([Wiki](https://en.wikipedia.org/wiki/System_Integrity_Protection)) enabled (default setting) on client machines.
|
||||
SIP is a built-in macOS security feature that prevents low-level tampering with the OS.
|
||||
|
||||
## Installation and configuration overview
|
||||
There are various methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac.
|
||||
In general you'll need to take the following steps:
|
||||
- [Register macOS devices](#register-macos-devices) with Windows Defender ATP
|
||||
- Deploy Microsoft Defender ATP for Mac using any of the following deployment methods and tools:
|
||||
- [Register macOS devices](#register-macos-devices) with Windows Defender ATP
|
||||
- Deploy Microsoft Defender ATP for Mac using any of the following deployment methods and tools:
|
||||
- [Microsoft Intune based deployment](#microsoft-intune-based-deployment)
|
||||
- [JAMF based deployment](#jamf-based-deployment)
|
||||
- [Manual deployment](#manual-deployment)
|
||||
|
||||
## Register macOS devices
|
||||
To onboard your devices for Microsoft Defender ATP for Mac, you must register the devices with Windows Defender ATP and provide consent to submit telemetry.
|
||||
|
||||
Use the following URL to give consent to submit telemetry: ```https://login.microsoftonline.com/common/oauth2/authorize?prompt=consent&client_id=f9eb614c-7a8e-422a-947d-2059e657d855&response_type=code&sso_reload=true```
|
||||
|
||||
> [!NOTE]
|
||||
> You may get an error that a page on ```https://ppe.fresno.wd.microsoft.com``` cannot be opened. Disregard the error as it does not affect the onboarding process.
|
||||
|
||||
|
||||
|
||||
|
||||
## Deploy Microsoft Defender ATP for Mac
|
||||
Use any of the supported methods to deploy Microsoft Defender ATP for Mac
|
||||
|
||||
@ -72,11 +69,11 @@ Use any of the supported methods to deploy Microsoft Defender ATP for Mac
|
||||
|
||||
### Download installation and onboarding packages
|
||||
Download the installation and onboarding packages from Windows Defender Security Center:
|
||||
1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**.
|
||||
2. In Section 1 of the page, set operating system to **Linux, macOS, iOS or Android** and Deployment method to **Mobile Device Management / Microsoft Intune**.
|
||||
3. In Section 2 of the page, click **Download installation package**. Save it as wdav.pkg to a local directory.
|
||||
4. In Section 2 of the page, click **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.
|
||||
5. Download IntuneAppUtil from https://docs.microsoft.com/en-us/intune/lob-apps-macos.
|
||||
1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**.
|
||||
2. In Section 1 of the page, set operating system to **Linux, macOS, iOS or Android** and Deployment method to **Mobile Device Management / Microsoft Intune**.
|
||||
3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory.
|
||||
4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.
|
||||
5. Download IntuneAppUtil from https://docs.microsoft.com/en-us/intune/lob-apps-macos.
|
||||
|
||||
|
||||
|
||||
@ -97,7 +94,7 @@ Download the installation and onboarding packages from Windows Defender Security
|
||||
inflating: jamf/WindowsDefenderATPOnboarding.plist
|
||||
mavel-macmini:Downloads test$
|
||||
```
|
||||
7. Make IntuneAppUtil an executable:
|
||||
7. Make IntuneAppUtil an executable:
|
||||
|
||||
```mavel-macmini:Downloads test$ chmod +x IntuneAppUtil```
|
||||
|
||||
@ -124,10 +121,12 @@ You need no special provisioning for a Mac machine beyond a standard [Company Po
|
||||
|
||||
|
||||
|
||||
2. Click the **Continue** button, and your Management Profile is displayed as verified:
|
||||
Select Open System Preferences, locate Management Profile on the list and select the **Approve...** button. Your Management Profile would be displayed as **Verified**:
|
||||
|
||||
|
||||
|
||||
2. Select the **Continue** button and complete the enrollment.
|
||||
|
||||
You can enroll additional machines. Optionally, you can do it later, after system configuration and application package are provisioned.
|
||||
|
||||
3. In Intune, open the **Manage > Devices > All devices** blade. You'll see your machine:
|
||||
@ -135,17 +134,17 @@ You can enroll additional machines. Optionally, you can do it later, after syste
|
||||
|
||||
|
||||
### Create System Configuration profiles
|
||||
1. In Intune open the **Manage > Device configuration** blade. Click **Manage > Profiles > Create Profile**.
|
||||
2. Choose a name for the profile. Change **Platform=macOS**, **Profile type=Custom**. Click **Configure**.
|
||||
3. Open the configuration profile and upload intune/kext.xml. This file was created during the Generate settings step above.
|
||||
4. Click **OK**.
|
||||
1. In Intune open the **Manage > Device configuration** blade. Select **Manage > Profiles > Create Profile**.
|
||||
2. Choose a name for the profile. Change **Platform=macOS**, **Profile type=Custom**. Select **Configure**.
|
||||
3. Open the configuration profile and upload intune/kext.xml. This file was created during the Generate settings step above.
|
||||
4. Select **OK**.
|
||||
|
||||
|
||||
|
||||
5. **Click Manage > Assignments**. In the **Include** tab, click **Assign to All Users & All devices**.
|
||||
7. Repeat these steps with the second profile.
|
||||
8. Create Profile one more time, give it a name, upload the intune/WindowsDefenderATPOnboarding.xml file.
|
||||
9. Click **Manage > Assignments**. In the Include tab, click **Assign to All Users & All devices**.
|
||||
5. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
|
||||
7. Repeat these steps with the second profile.
|
||||
8. Create Profile one more time, give it a name, upload the intune/WindowsDefenderATPOnboarding.xml file.
|
||||
9. Select **Manage > Assignments**. In the Include tab, select **Assign to All Users & All devices**.
|
||||
|
||||
After Intune changes are propagated to the enrolled machines, you'll see it on the **Monitor > Device status** blade:
|
||||
|
||||
@ -153,24 +152,24 @@ After Intune changes are propagated to the enrolled machines, you'll see it on t
|
||||
|
||||
### Publish application
|
||||
|
||||
1. In Intune, open the **Manage > Client apps** blade. Click **Apps > Add**.
|
||||
2. Select **App type=Other/Line-of-business app**.
|
||||
3. Select **file=wdav.pkg.intunemac**. Click **OK** to upload.
|
||||
4. Click **Configure** and add the required information.
|
||||
5. Use **macOS Sierra 10.12** as the minimum OS. Other settings can be any other value.
|
||||
1. In Intune, open the **Manage > Client apps** blade. Select **Apps > Add**.
|
||||
2. Select **App type=Other/Line-of-business app**.
|
||||
3. Select **file=wdav.pkg.intunemac**. Select **OK** to upload.
|
||||
4. Select **Configure** and add the required information.
|
||||
5. Use **macOS Sierra 10.12** as the minimum OS. Other settings can be any other value.
|
||||
|
||||
|
||||
|
||||
6. Click **OK** and **Add**.
|
||||
6. Select **OK** and **Add**.
|
||||
|
||||
|
||||
|
||||
7. It will take a while to upload the package. After it's done, click the name and then go to **Assignments** and **Add group**.
|
||||
7. It will take a while to upload the package. After it's done, select the name and then go to **Assignments** and **Add group**.
|
||||
|
||||
|
||||
|
||||
8. Change **Assignment type=Required**.
|
||||
9. Click **Included Groups**. Select **Make this app required for all devices=Yes**. Click **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**.
|
||||
9. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Select **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**.
|
||||
|
||||
|
||||
|
||||
@ -179,7 +178,7 @@ After Intune changes are propagated to the enrolled machines, you'll see it on t
|
||||
|
||||
|
||||
### Verify client machine state
|
||||
1. After the configuration profiles are deployed to your machines, on your Mac device, open **System Preferences > Profiles**.
|
||||
1. After the configuration profiles are deployed to your machines, on your Mac device, open **System Preferences > Profiles**.
|
||||
|
||||
|
||||
|
||||
@ -187,9 +186,9 @@ After Intune changes are propagated to the enrolled machines, you'll see it on t
|
||||
2. Verify the three profiles listed there:
|
||||
|
||||
|
||||
3. The **Management Profile** should be the Intune system profile.
|
||||
4. wdav-config and wdav-kext are system configuration profiles that we added in Intune.
|
||||
5. You should also see the Microsoft Defender icon in the top-right corner:
|
||||
3. The **Management Profile** should be the Intune system profile.
|
||||
4. wdav-config and wdav-kext are system configuration profiles that we added in Intune.
|
||||
5. You should also see the Microsoft Defender icon in the top-right corner:
|
||||
|
||||
|
||||
|
||||
@ -200,10 +199,10 @@ You need to be familiar with JAMF administration tasks, have a JAMF tenant, and
|
||||
|
||||
### Download installation and onboarding packages
|
||||
Download the installation and onboarding packages from Windows Defender Security Center:
|
||||
1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**.
|
||||
2. In Section 1 of the page, set operating system to **Linux, macOS, iOS or Android** and Deployment method to **Mobile Device Management / Microsoft Intune**.
|
||||
3. In Section 2 of the page, click **Download installation package**. Save it as wdav.pkg to a local directory.
|
||||
4. In Section 2 of the page, click **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.
|
||||
1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**.
|
||||
2. In Section 1 of the page, set operating system to **Linux, macOS, iOS or Android** and Deployment method to **Mobile Device Management / Microsoft Intune**.
|
||||
3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory.
|
||||
4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.
|
||||
|
||||
|
||||
|
||||
@ -244,15 +243,15 @@ The configuration profile contains one custom settings payload that includes:
|
||||
#### Approved Kernel Extension
|
||||
|
||||
To approve the kernel extension:
|
||||
1. In **Computers > Configuration Profiles** click **Options > Approved Kernel Extensions**.
|
||||
2. Use **UBF8T346G9** for Team Id.
|
||||
1. In **Computers > Configuration Profiles** select **Options > Approved Kernel Extensions**.
|
||||
2. Use **UBF8T346G9** for Team Id.
|
||||
|
||||
|
||||
|
||||
#### Configuration Profile's Scope
|
||||
Configure the appropriate scope to specify the machines that will receive this configuration profile.
|
||||
|
||||
In the Configuration Profiles, click **Scope > Targets**. Select the appropriate Target computers.
|
||||
Open Computers -> Configuration Profiles, select **Scope > Targets**. Select the appropriate Target computers.
|
||||
|
||||
|
||||
|
||||
@ -283,7 +282,7 @@ You need no special provisioning for a macOS computer beyond the standard JAMF E
|
||||
> [!NOTE]
|
||||
> After a computer is enrolled, it will show up in the Computers inventory (All Computers).
|
||||
|
||||
1. Open the machine details, from **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's set to No, the user needs to open **System Preferences > Profiles** and click **Approve** on the MDM Profile.
|
||||
1. Open the machine details, from **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile.
|
||||
|
||||
|
||||
|
||||
@ -384,10 +383,10 @@ This script returns 0 if Microsoft Defender ATP is registered with the Windows D
|
||||
|
||||
### Download installation and onboarding packages
|
||||
Download the installation and onboarding packages from Windows Defender Security Center:
|
||||
1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**.
|
||||
2. In Section 1 of the page, set operating system to **Linux, macOS, iOS or Android** and Deployment method to **Mobile Device Management / Microsoft Intune**.
|
||||
3. In Section 2 of the page, click **Download installation package**. Save it as wdav.pkg to a local directory.
|
||||
4. In Section 2 of the page, click **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.
|
||||
1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**.
|
||||
2. In Section 1 of the page, set operating system to **Linux, macOS, iOS or Android** and Deployment method to **Local script**.
|
||||
3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory.
|
||||
4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.
|
||||
|
||||
|
||||
|
||||
@ -407,13 +406,11 @@ Download the installation and onboarding packages from Windows Defender Security
|
||||
### Application installation
|
||||
To complete this process, you must have admin privileges on the machine.
|
||||
|
||||
1. Download the wdav.pkg from: https://fresno.blob.core.windows.net/preview/macos/wdav.pkg.
|
||||
|
||||
2. Navigate to the downloaded wdav.pkg in Finder and open it.
|
||||
1. Navigate to the downloaded wdav.pkg in Finder and open it.
|
||||
|
||||
|
||||
|
||||
3. Click **Continue**, agree with the License terms, and enter the password when prompted.
|
||||
2. Select **Continue**, agree with the License terms, and enter the password when prompted.
|
||||
|
||||
|
||||
|
||||
@ -422,7 +419,7 @@ To complete this process, you must have admin privileges on the machine.
|
||||
|
||||
|
||||
|
||||
4. Click **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Click **Allow**:
|
||||
3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**:
|
||||
|
||||
|
||||
|
||||
@ -430,10 +427,10 @@ To complete this process, you must have admin privileges on the machine.
|
||||
The installation will proceed.
|
||||
|
||||
> [!NOTE]
|
||||
> If you don't click **Allow**, the installation will fail after 5 minutes. You can restart it again at any time.
|
||||
> If you don't select **Allow**, the installation will fail after 5 minutes. You can restart it again at any time.
|
||||
|
||||
### Client configuration
|
||||
1. Copy wdav.pkg and WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Mac.
|
||||
1. Copy wdav.pkg and WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Mac.
|
||||
|
||||
The client machine is not associated with orgId. Note that the orgid is blank.
|
||||
|
||||
@ -442,14 +439,14 @@ The installation will proceed.
|
||||
uuid : 69EDB575-22E1-53E1-83B8-2E1AB1E410A6
|
||||
orgid :
|
||||
```
|
||||
2. Install the configuration file on a client machine:
|
||||
2. Install the configuration file on a client machine:
|
||||
|
||||
```
|
||||
mavel-mojave:wdavconfig testuser$ python WindowsDefenderATPOnboarding.py
|
||||
Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password)
|
||||
```
|
||||
|
||||
3. Verify that the machine is now associated with orgId:
|
||||
3. Verify that the machine is now associated with orgId:
|
||||
|
||||
```
|
||||
mavel-mojave:wdavconfig testuser$ /Library/Extensions/wdavkext.kext/Contents/Resources/Tools/wdavconfig.py
|
||||
@ -472,17 +469,45 @@ Or, from a command line:
|
||||
|
||||
## Known issues
|
||||
- Microsoft Defender ATP is not yet optimized for performance or disk space.
|
||||
- Centrally managed uninstall using Intune/JAMF is still in development. To uninstall (as a workaround) an uninstall action has to be completed on each client device).
|
||||
- Centrally managed uninstall using Intune is still in development. To uninstall (as a workaround) a manual uninstall action has to be completed on each client device).
|
||||
- Geo preference for telemetry traffic is not yet supported. Cloud traffic (definition updates) routed to US only.
|
||||
- Full Windows Defender ATP integration is not yet available
|
||||
- Not localized yet
|
||||
- There might be accessibility issues
|
||||
|
||||
## Collecting diagnostic information
|
||||
If you can reproduce a problem, please increase the logging level, run the system for some time, and restore the logging level to the default.
|
||||
|
||||
1) Increase logging level:
|
||||
```
|
||||
mavel-mojave:~ testuser$ mdatp log-level --verbose
|
||||
Creating connection to daemon
|
||||
Connection established
|
||||
Operation succeeded
|
||||
```
|
||||
|
||||
2) Reproduce the problem
|
||||
|
||||
3) Run `mdatp --diagnostic` to backup Defender ATP's logs. The command will print out location with generated zip file.
|
||||
|
||||
```
|
||||
mavel-mojave:~ testuser$ mdatp --diagnostic
|
||||
Creating connection to daemon
|
||||
Connection established
|
||||
"/Library/Application Support/Microsoft/Defender/wdavdiag/d85e7032-adf8-434a-95aa-ad1d450b9a2f.zip"
|
||||
```
|
||||
|
||||
4) Restore logging level:
|
||||
```
|
||||
mavel-mojave:~ testuser$ mdatp log-level --info
|
||||
Creating connection to daemon
|
||||
Connection established
|
||||
Operation succeeded
|
||||
```
|
||||
|
||||
|
||||
### Installation issues
|
||||
If an error occurs during installation, the installer will only report a general failure. The detailed log is saved to /Library/Logs/Microsoft/wdav.install.log. If you experience issues during installation, send us this file so we can help diagnose the cause. You can also contact _**xplatpreviewsupport@microsoft.com**_ for support on onboarding issues.
|
||||
|
||||
|
||||
For feedback on the preview, contact: _**mdatpfeedback@microsoft.com**_.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -75,7 +75,7 @@ Location | Setting | Description | Default setting (if not configured)
|
||||
Scan | Specify the scan type to use for a scheduled scan | Quick scan
|
||||
Scan | Specify the day of the week to run a scheduled scan | Specify the day (or never) to run a scan. | Never
|
||||
Scan | Specify the time of day to run a scheduled scan | Specify the number of minutes after midnight (for example, enter **60** for 1 am). | 2 am
|
||||
Root | Randomize scheduled task times | Randomize the start time of the scan to any interval from 0 to 4 hours, or to any interval plus or minus 30 minutes for non-Windows Defender Antivirus scans. This can be useful in VM or VDI deployments. | Enabled
|
||||
Root | Randomize scheduled task times |In Windows Defender Antivirus: Randomize the start time of the scan to any interval from 0 to 4 hours. <br>In FEP/SCEP: randomize to any interval plus or minus 30 minutes. This can be useful in VM or VDI deployments. | Enabled
|
||||
|
||||
**Use PowerShell cmdlets to schedule scans:**
|
||||
|
||||
|
||||
@ -36,6 +36,6 @@ Your environment needs the following software to run Windows Defender Applicatio
|
||||
|
||||
|Software|Description|
|
||||
|--------|-----------|
|
||||
|Operating system|Windows 10 Enterprise edition, version 1709 or higher<br>Windows 10 Professional edition, version 1803|
|
||||
|Operating system|Windows 10 Enterprise edition, version 1709 or higher<br>Windows 10 Professional edition, version 1803 or higher<br>Windows 10 Education edition, version 1709 or higher<br>Windows 10 Pro Education edition, version 1803 or higher|
|
||||
|Browser|Microsoft Edge and Internet Explorer|
|
||||
|Management system<br> (only for managed devices)|[Microsoft Intune](https://docs.microsoft.com/intune/)<br><br>**-OR-**<br><br>[System Center Configuration Manager](https://docs.microsoft.com/sccm/)<br><br>**-OR-**<br><br>[Group Policy](https://technet.microsoft.com/library/cc753298(v=ws.11).aspx)<br><br>**-OR-**<br><br>Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.|
|
||||
|
||||
@ -333,6 +333,7 @@
|
||||
#### Reporting
|
||||
##### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Threat protection reports](threat-protection-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Machine health and compliance reports](machine-reports-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
#### Role-based access control
|
||||
##### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,238 +1,238 @@
|
||||
---
|
||||
title: Onboard servers to the Windows Defender ATP service
|
||||
description: Onboard servers so that they can send sensor data to the Windows Defender ATP sensor.
|
||||
keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, machine management, configure Windows ATP servers, onboard Windows Defender Advanced Threat Protection servers
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Onboard servers to the Windows Defender ATP service
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
- Windows Server, version 1803
|
||||
- Windows Server, 2019
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
|
||||
|
||||
Windows Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console.
|
||||
|
||||
The service supports the onboarding of the following servers:
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
- Windows Server, version 1803
|
||||
- Windows Server 2019
|
||||
|
||||
|
||||
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Windows Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
|
||||
|
||||
## Windows Server 2012 R2 and Windows Server 2016
|
||||
|
||||
There are two options to onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP:
|
||||
|
||||
- **Option 1**: Onboard through Azure Security Center
|
||||
- **Option 2**: Onboard through Windows Defender Security Center
|
||||
|
||||
### Option 1: Onboard servers through Azure Security Center
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
|
||||
2. Select Windows Server 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Onboard Servers in Azure Security Center**.
|
||||
|
||||
4. Follow the onboarding instructions in [Windows Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
|
||||
### Option 2: Onboard servers through Windows Defender Security Center
|
||||
You'll need to tak the following steps if you choose to onboard servers through Windows Defender Security Center.
|
||||
|
||||
- For Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients.
|
||||
|
||||
>[!NOTE]
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
- Turn on server monitoring from Windows Defender Security Center.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Operations Management Suite (OMS), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through Multi Homing support. Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below.
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
### Configure and update System Center Endpoint Protection clients
|
||||
>[!IMPORTANT]
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
Windows Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
|
||||
The following steps are required to enable this integration:
|
||||
- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie)
|
||||
- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting
|
||||
|
||||
|
||||
### Turn on Server monitoring from the Windows Defender Security Center portal
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
|
||||
2. Select Windows Server 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
|
||||
<span id="server-mma"/>
|
||||
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP
|
||||
|
||||
1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603).
|
||||
|
||||
2. Using the Workspace ID and Workspace key provided in the previous procedure, choose any of the following installation methods to install the agent on the server:
|
||||
- [Manually install the agent using setup](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-setup) <br>
|
||||
On the **Agent Setup Options** page, choose **Connect the agent to Azure Log Analytics (OMS)**.
|
||||
- [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script).
|
||||
|
||||
3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#configure-proxy-settings).
|
||||
|
||||
Once completed, you should see onboarded servers in the portal within an hour.
|
||||
|
||||
<span id="server-proxy"/>
|
||||
### Configure server proxy and Internet connectivity settings
|
||||
|
||||
- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the [OMS Gateway](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway).
|
||||
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service:
|
||||
|
||||
Agent Resource | Ports
|
||||
:---|:---
|
||||
| *.oms.opinsights.azure.com | 443 |
|
||||
| *.blob.core.windows.net | 443 |
|
||||
| *.azure-automation.net | 443 |
|
||||
| *.ods.opinsights.azure.com | 443 |
|
||||
| winatp-gw-cus.microsoft.com | 443 |
|
||||
| winatp-gw-eus.microsoft.com | 443 |
|
||||
| winatp-gw-neu.microsoft.com | 443 |
|
||||
| winatp-gw-weu.microsoft.com | 443 |
|
||||
|winatp-gw-uks.microsoft.com | 443 |
|
||||
|winatp-gw-ukw.microsoft.com | 443 |
|
||||
| winatp-gw-aus.microsoft.com | 443|
|
||||
| winatp-gw-aue.microsoft.com |443 |
|
||||
|
||||
## Windows Server, version 1803 and Windows Server 2019
|
||||
To onboard Windows Server, version 1803 or Windows Server 2019, use the same method used when onboarding Windows 10 machines.
|
||||
|
||||
Supported tools include:
|
||||
- Local script
|
||||
- Group Policy
|
||||
- System Center Configuration Manager 2012 / 2012 R2 1511 / 1602
|
||||
- VDI onboarding scripts for non-persistent machines
|
||||
|
||||
For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). Support for Windows Server, version 1803 and Windows 2019 provides deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
|
||||
1. Configure Windows Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
2. If you’re running a third party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings and verify it was configured correctly:
|
||||
|
||||
a. Set the following registry entry:
|
||||
- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`
|
||||
- Name: ForceDefenderPassiveMode
|
||||
- Value: 1
|
||||
|
||||
b. Run the following PowerShell command to verify that the passive mode was configured:
|
||||
|
||||
```Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-Sense" ;ID=84}```
|
||||
|
||||
c. Confirm that a recent event containing the passive mode event is found:
|
||||
|
||||
|
||||
|
||||
3. Run the following command to check if Windows Defender AV is installed:
|
||||
|
||||
```sc query Windefend```
|
||||
|
||||
If the result is ‘The specified service does not exist as an installed service’, then you'll need to install Windows Defender AV. For more information, see [Windows Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10).
|
||||
|
||||
|
||||
## Integration with Azure Security Center
|
||||
Windows Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Windows Defender ATP to provide improved threat detection for Windows Servers.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
The following capabilities are included in this integration:
|
||||
- Automated onboarding - Windows Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
|
||||
|
||||
>[!NOTE]
|
||||
> Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016.
|
||||
|
||||
- Servers monitored by Azure Security Center will also be available in Windows Defender ATP - Azure Security Center seamlessly connects to the Windows Defender ATP tenant, providing a single view across clients and servers. In addition, Windows Defender ATP alerts will be available in the Azure Security Center console.
|
||||
- Server investigation - Azure Security Center customers can access Windows Defender Security Center to perform detailed investigation to uncover the scope of a potential breach
|
||||
|
||||
>[!IMPORTANT]
|
||||
>- When you use Azure Security Center to monitor servers, a Windows Defender ATP tenant is automatically created. The Windows Defender ATP data is stored in Europe by default.
|
||||
>- If you use Windows Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
|
||||
|
||||
|
||||
|
||||
## Offboard servers
|
||||
You can offboard Windows Server, version 1803 and Windows 2019 in the same method available for Windows 10 client machines.
|
||||
|
||||
For other server versions, you have two options to offboard servers from the service:
|
||||
- Uninstall the MMA agent
|
||||
- Remove the Windows Defender ATP workspace configuration
|
||||
|
||||
>[!NOTE]
|
||||
>Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
|
||||
### Uninstall servers by uinstalling the MMA agent
|
||||
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Windows Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Windows Defender ATP.
|
||||
For more information, see [To disable an agent](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).
|
||||
|
||||
### Remove the Windows Defender ATP workspace configuration
|
||||
To offboard the server, you can use either of the following methods:
|
||||
|
||||
- Remove the Windows Defender ATP workspace configuration from the MMA agent
|
||||
- Run a PowerShell command to remove the configuration
|
||||
|
||||
#### Remove the Windows Defender ATP workspace configuration from the MMA agent
|
||||
|
||||
1. In the **Microsoft Monitoring Agent Properties**, select the **Azure Log Analytics (OMS)** tab.
|
||||
|
||||
2. Select the Windows Defender ATP workspace, and click **Remove**.
|
||||
|
||||
|
||||
|
||||
#### Run a PowerShell command to remove the configuration
|
||||
|
||||
1. Get your Workspace ID:
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
b. Select **Windows Server 2012 R2 and 2016** as the operating system and get your Workspace ID:
|
||||
|
||||
|
||||
|
||||
2. Open an elevated PowerShell and run the following command. Use the Workspace ID you obtained and replacing `WorkspaceID`:
|
||||
|
||||
```
|
||||
# Load agent scripting object
|
||||
$AgentCfg = New-Object -ComObject AgentConfigManager.MgmtSvcCfg
|
||||
# Remove OMS Workspace
|
||||
$AgentCfg.RemoveCloudWorkspace($WorkspaceID)
|
||||
# Reload the configuration and apply changes
|
||||
$AgentCfg.ReloadConfiguration()
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshooting Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
---
|
||||
title: Onboard servers to the Windows Defender ATP service
|
||||
description: Onboard servers so that they can send sensor data to the Windows Defender ATP sensor.
|
||||
keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, machine management, configure Windows ATP servers, onboard Windows Defender Advanced Threat Protection servers
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Onboard servers to the Windows Defender ATP service
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
- Windows Server, version 1803
|
||||
- Windows Server, 2019
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
|
||||
|
||||
Windows Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console.
|
||||
|
||||
The service supports the onboarding of the following servers:
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
- Windows Server, version 1803
|
||||
- Windows Server 2019
|
||||
|
||||
|
||||
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Windows Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
|
||||
|
||||
## Windows Server 2012 R2 and Windows Server 2016
|
||||
|
||||
There are two options to onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP:
|
||||
|
||||
- **Option 1**: Onboard through Azure Security Center
|
||||
- **Option 2**: Onboard through Windows Defender Security Center
|
||||
|
||||
### Option 1: Onboard servers through Azure Security Center
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
|
||||
2. Select Windows Server 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Onboard Servers in Azure Security Center**.
|
||||
|
||||
4. Follow the onboarding instructions in [Windows Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
|
||||
### Option 2: Onboard servers through Windows Defender Security Center
|
||||
You'll need to tak the following steps if you choose to onboard servers through Windows Defender Security Center.
|
||||
|
||||
- For Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients.
|
||||
|
||||
>[!NOTE]
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
- Turn on server monitoring from Windows Defender Security Center.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through Multi Homing support. Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
|
||||
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
### Configure and update System Center Endpoint Protection clients
|
||||
>[!IMPORTANT]
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
Windows Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
|
||||
The following steps are required to enable this integration:
|
||||
- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie)
|
||||
- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting
|
||||
|
||||
|
||||
### Turn on Server monitoring from the Windows Defender Security Center portal
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
|
||||
2. Select Windows Server 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
|
||||
<span id="server-mma"/>
|
||||
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP
|
||||
|
||||
1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603).
|
||||
|
||||
2. Using the Workspace ID and Workspace key provided in the previous procedure, choose any of the following installation methods to install the agent on the server:
|
||||
- [Manually install the agent using setup](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-setup) <br>
|
||||
On the **Agent Setup Options** page, choose **Connect the agent to Azure Log Analytics (OMS)**.
|
||||
- [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script).
|
||||
|
||||
3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#configure-proxy-settings).
|
||||
|
||||
Once completed, you should see onboarded servers in the portal within an hour.
|
||||
|
||||
<span id="server-proxy"/>
|
||||
### Configure server proxy and Internet connectivity settings
|
||||
|
||||
- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the [OMS Gateway](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway).
|
||||
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service:
|
||||
|
||||
Agent Resource | Ports
|
||||
:---|:---
|
||||
| *.oms.opinsights.azure.com | 443 |
|
||||
| *.blob.core.windows.net | 443 |
|
||||
| *.azure-automation.net | 443 |
|
||||
| *.ods.opinsights.azure.com | 443 |
|
||||
| winatp-gw-cus.microsoft.com | 443 |
|
||||
| winatp-gw-eus.microsoft.com | 443 |
|
||||
| winatp-gw-neu.microsoft.com | 443 |
|
||||
| winatp-gw-weu.microsoft.com | 443 |
|
||||
|winatp-gw-uks.microsoft.com | 443 |
|
||||
|winatp-gw-ukw.microsoft.com | 443 |
|
||||
| winatp-gw-aus.microsoft.com | 443|
|
||||
| winatp-gw-aue.microsoft.com |443 |
|
||||
|
||||
## Windows Server, version 1803 and Windows Server 2019
|
||||
To onboard Windows Server, version 1803 or Windows Server 2019, use the same method used when onboarding Windows 10 machines.
|
||||
|
||||
Supported tools include:
|
||||
- Local script
|
||||
- Group Policy
|
||||
- System Center Configuration Manager 2012 / 2012 R2 1511 / 1602
|
||||
- VDI onboarding scripts for non-persistent machines
|
||||
|
||||
For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). Support for Windows Server, version 1803 and Windows 2019 provides deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
|
||||
1. Configure Windows Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
2. If you’re running a third party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings and verify it was configured correctly:
|
||||
|
||||
a. Set the following registry entry:
|
||||
- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`
|
||||
- Name: ForceDefenderPassiveMode
|
||||
- Value: 1
|
||||
|
||||
b. Run the following PowerShell command to verify that the passive mode was configured:
|
||||
|
||||
```Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-Sense" ;ID=84}```
|
||||
|
||||
c. Confirm that a recent event containing the passive mode event is found:
|
||||
|
||||
|
||||
|
||||
3. Run the following command to check if Windows Defender AV is installed:
|
||||
|
||||
```sc query Windefend```
|
||||
|
||||
If the result is ‘The specified service does not exist as an installed service’, then you'll need to install Windows Defender AV. For more information, see [Windows Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10).
|
||||
|
||||
|
||||
## Integration with Azure Security Center
|
||||
Windows Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Windows Defender ATP to provide improved threat detection for Windows Servers.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
The following capabilities are included in this integration:
|
||||
- Automated onboarding - Windows Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
|
||||
|
||||
>[!NOTE]
|
||||
> Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016.
|
||||
|
||||
- Servers monitored by Azure Security Center will also be available in Windows Defender ATP - Azure Security Center seamlessly connects to the Windows Defender ATP tenant, providing a single view across clients and servers. In addition, Windows Defender ATP alerts will be available in the Azure Security Center console.
|
||||
- Server investigation - Azure Security Center customers can access Windows Defender Security Center to perform detailed investigation to uncover the scope of a potential breach
|
||||
|
||||
>[!IMPORTANT]
|
||||
>- When you use Azure Security Center to monitor servers, a Windows Defender ATP tenant is automatically created. The Windows Defender ATP data is stored in Europe by default.
|
||||
>- If you use Windows Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
|
||||
|
||||
|
||||
|
||||
## Offboard servers
|
||||
You can offboard Windows Server, version 1803 and Windows 2019 in the same method available for Windows 10 client machines.
|
||||
|
||||
For other server versions, you have two options to offboard servers from the service:
|
||||
- Uninstall the MMA agent
|
||||
- Remove the Windows Defender ATP workspace configuration
|
||||
|
||||
>[!NOTE]
|
||||
>Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
|
||||
### Uninstall servers by uinstalling the MMA agent
|
||||
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Windows Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Windows Defender ATP.
|
||||
For more information, see [To disable an agent](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).
|
||||
|
||||
### Remove the Windows Defender ATP workspace configuration
|
||||
To offboard the server, you can use either of the following methods:
|
||||
|
||||
- Remove the Windows Defender ATP workspace configuration from the MMA agent
|
||||
- Run a PowerShell command to remove the configuration
|
||||
|
||||
#### Remove the Windows Defender ATP workspace configuration from the MMA agent
|
||||
|
||||
1. In the **Microsoft Monitoring Agent Properties**, select the **Azure Log Analytics (OMS)** tab.
|
||||
|
||||
2. Select the Windows Defender ATP workspace, and click **Remove**.
|
||||
|
||||
|
||||
|
||||
#### Run a PowerShell command to remove the configuration
|
||||
|
||||
1. Get your Workspace ID:
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
b. Select **Windows Server 2012 R2 and 2016** as the operating system and get your Workspace ID:
|
||||
|
||||
|
||||
|
||||
2. Open an elevated PowerShell and run the following command. Use the Workspace ID you obtained and replacing `WorkspaceID`:
|
||||
|
||||
```
|
||||
# Load agent scripting object
|
||||
$AgentCfg = New-Object -ComObject AgentConfigManager.MgmtSvcCfg
|
||||
# Remove OMS Workspace
|
||||
$AgentCfg.RemoveCloudWorkspace($WorkspaceID)
|
||||
# Reload the configuration and apply changes
|
||||
$AgentCfg.ReloadConfiguration()
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 97 KiB |
@ -0,0 +1,84 @@
|
||||
---
|
||||
title: Machine health and compliance report in Windows Defender ATP
|
||||
description: Track machine health state detections, antivirus status, OS platform, and Windows 10 versions using the machine health and compliance report
|
||||
keywords: health state, antivirus, os platform, windows 10 version, version, health, compliance, state
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Machine health and compliance report in Windows Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The machines status report provides high-level information about the devices in your organization. The report includes trending information showing the sensor health state, antivirus status, OS platforms, and Windows 10 versions.
|
||||
|
||||
|
||||
The dashboard is structured into two sections:
|
||||
|
||||
|
||||
Section | Description
|
||||
:---|:---
|
||||
1 | Machine trends
|
||||
2 | Machine summary (current day)
|
||||
|
||||
|
||||
|
||||
By default, the machine trends displays machine information from the 30-day period ending in the latest full day. To gain better perspective on trends occurring in your organization, you can fine-tune the reporting period by adjusting the time period shown. To adjust the time period, select a time range from the drop-down options:
|
||||
|
||||
- 30 days
|
||||
- 3 months
|
||||
- 6 months
|
||||
- Custom
|
||||
|
||||
While the machines trends shows trending machine information, the machine summary shows machine information scoped to the current day.
|
||||
|
||||
The machine trends section allows you to drill down to the machines list with the corresponding filter applied to it. For example, clicking on the Inactive bar in the Sensor health state card will bring you the machines list with results showing only machines whose sensor status is inactive.
|
||||
|
||||
|
||||
|
||||
|
||||
## Machine attributes
|
||||
The report is made up of cards that display the following machine attributes:
|
||||
|
||||
- **Health state**: shows information about the sensor state on devices, providing an aggregated view of devices that are active, experiencing impaired communications, inactive, or where no sensor data is seen.
|
||||
|
||||
- **Antivirus status for active Windows 10 machines**: shows the number of machines and status of Windows Defender Antivirus.
|
||||
|
||||
- **OS platforms**: shows the distribution of OS platforms that exists within your organization.
|
||||
|
||||
- **Windows 10 versions**: shows the distribution of Windows 10 machines and their versions in your organization.
|
||||
|
||||
|
||||
|
||||
## Filter data
|
||||
|
||||
Use the provided filters to include or exclude machines with certain attributes.
|
||||
|
||||
You can select multiple filters to apply from the machine attributes.
|
||||
|
||||
>[!NOTE]
|
||||
>These filters apply to **all** the cards in the report.
|
||||
|
||||
For example, to show data about Windows 10 machines with Active sensor health state:
|
||||
|
||||
1. Under **Filters > Sensor health state > Active**.
|
||||
2. Then select **OS platforms > Windows 10**.
|
||||
3. Select **Apply**.
|
||||
|
||||
|
||||
## Related topic
|
||||
- [Threat protection report ](threat-protection-reports-windows-defender-advanced-threat-protection.md)
|
||||
@ -57,7 +57,9 @@ On the top navigation you can:
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Blocking IPs, domains, or URLs is currently available on limited preview only. This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforeced. While the option is not yet generally available, it will only be used when identified during an investigation.
|
||||
>Blocking IPs, domains, or URLs is currently available on limited preview only.
|
||||
>This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforced which is an option that will be generally available soon.
|
||||
>As it is not yet generally available, when Automated investigations finds this indicator during an investigation it will use the allowed/block list as the basis of its decision to automatically remediate (blocked list) or skip (allowed list) the entity.
|
||||
|
||||
|
||||
## Manage indicators
|
||||
|
||||
@ -15,7 +15,6 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
# Take response actions on a file
|
||||
@ -109,13 +108,17 @@ You can roll back and remove a file from quarantine if you’ve determined that
|
||||
You can prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. This operation will prevent it from being read, written, or executed on machines in your organization.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). </br></br>
|
||||
>- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md).
|
||||
>- The Antimalware client version must be 4.18.1901.x or later.
|
||||
>- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time.
|
||||
>- This response action is available for machines on Windows 10, version 1703 or later.
|
||||
>- The allow or block function cannot be done on files if the file's classification exists on the device's cache prior to the allow or block action.
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
> The PE file needs to be in the machine timeline for you to be able to take this action.
|
||||
|
||||
>- There may be a couple of minutes of latency between the time the action is taken and the actual file being blocked.
|
||||
|
||||
### Enable the block file feature
|
||||
Before you can block files, you'll need to enable the feature.
|
||||
@ -149,6 +152,9 @@ Before you can block files, you'll need to enable the feature.
|
||||
|
||||
When the file is blocked, there will be a new event in the machine timeline.</br>
|
||||
|
||||
>[!NOTE]
|
||||
>-If a file was scanned before the action was taken, it may take longer to be effective on the device.
|
||||
|
||||
**Notification on machine user**:</br>
|
||||
When a file is being blocked on the machine, the following notification is displayed to inform the user that the file was blocked:
|
||||
|
||||
|
||||
@ -31,7 +31,7 @@ ms.date: 11/12/2017
|
||||
You can take response actions on machines and files to quickly respond to detected attacks so that you can contain or reduce and prevent further damage caused by malicious attackers in your organization.
|
||||
|
||||
>[!NOTE]
|
||||
> These response actions are only available for machines on Windows 10, version 1703 or higher.
|
||||
> The machine related response actions are only available for machines on Windows 10 (version 1703 or higher), Windows Server, version 1803 and Windows Server 2019.
|
||||
|
||||
## In this section
|
||||
Topic | Description
|
||||
|
||||
@ -43,7 +43,7 @@ By default, the alert trends display alert information from the 30-day period en
|
||||
- 6 months
|
||||
- Custom
|
||||
|
||||
While the alerts trends shows trending information alerts, the alert summary shows alert information scoped to the current day.
|
||||
While the alert trends shows trending alert information, the alert summary shows alert information scoped to the current day.
|
||||
|
||||
The alert summary allows you to drill down to a particular alert queue with the corresponding filter applied to it. For example, clicking on the EDR bar in the Detection sources card will bring you the alerts queue with results showing only alerts generated from EDR detections.
|
||||
|
||||
@ -76,4 +76,7 @@ For example, to show data about high-severity alerts only:
|
||||
|
||||
1. Under **Filters > Severity**, select **High**
|
||||
2. Ensure that all other options under **Severity** are deselected.
|
||||
3. Select **Apply**.
|
||||
3. Select **Apply**.
|
||||
|
||||
## Related topic
|
||||
- [Machine health and compliance report](machine-reports-windows-defender-advanced-threat-protection.md)
|
||||
@ -23,6 +23,13 @@ ms.topic: conceptual
|
||||
|
||||
Here are the new features in the latest release of Windows Defender ATP as well as security features in Windows 10 and Windows Server.
|
||||
|
||||
## March 2019
|
||||
### In preview
|
||||
The following capability are included in the February 2019 preview release.
|
||||
|
||||
- [Machine health and compliance report](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection) <BR> The machine health and compliance report provides high-level information about the devices in your organization.
|
||||
|
||||
|
||||
## February 2019
|
||||
The following capabilities are generally available (GA).
|
||||
- [Incidents](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/incidents-queue) <BR> Incident is a new entity in Windows Defender ATP that brings together all relevant alerts and related entities to narrate the broader attack story, giving analysts better perspective on the purview of complex threats.
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/26/2018
|
||||
ms.date: 04/02/2019
|
||||
---
|
||||
|
||||
# Reduce attack surfaces with attack surface reduction rules
|
||||
@ -36,6 +36,29 @@ Triggered rules display a notification on the device. You can [customize the not
|
||||
|
||||
For information about configuring attack surface reduction rules, see [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
|
||||
|
||||
## Review attack surface reduction events in Windows Event Viewer
|
||||
|
||||
You can review the Windows event log to view events that are created when attack surface reduction rules fire:
|
||||
|
||||
1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the machine.
|
||||
|
||||
2. Type **Event Viewer** in the Start menu to open the Windows Event Viewer.
|
||||
|
||||
3. Click **Import custom view...** on the left panel, under **Actions**.
|
||||
|
||||
4. Select the file *cfa-events.xml* from where it was extracted. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
|
||||
|
||||
5. Click **OK**.
|
||||
|
||||
This will create a custom view that filters to only show the following events related to controlled folder access:
|
||||
|
||||
Event ID | Description
|
||||
-|-
|
||||
5007 | Event when settings are changed
|
||||
1121 | Event when rule fires in Block-mode
|
||||
1122 | Event when rule fires in Audit-mode
|
||||
|
||||
|
||||
## Attack surface reduction rules
|
||||
|
||||
The following sections describe each of the 15 attack surface reduction rules. This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use System Center Configuration Manager or Microsoft Intune, you do not need the GUIDs:
|
||||
@ -152,7 +175,12 @@ This rule blocks the following file types from launching unless they either meet
|
||||
>[!NOTE]
|
||||
>You must [enable cloud-delivered protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) to use this rule.
|
||||
|
||||
Intune name: Executables that don't meet a prevalence, age, or trusted list criteria
|
||||
>[!IMPORTANT]
|
||||
>The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly.
|
||||
>
|
||||
>You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to.
|
||||
|
||||
Intune name: Executables that don't meet a prevalence, age, or trusted list criteria.
|
||||
|
||||
SCCM name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria
|
||||
|
||||
@ -236,15 +264,6 @@ SCCM name: Not applicable
|
||||
|
||||
GUID: 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
|
||||
|
||||
## Review attack surface reduction events in Windows Event Viewer
|
||||
|
||||
You can review the Windows event log to see events that are created when attack surface rules block (or audit) an app:
|
||||
|
||||
Event ID | Description
|
||||
5007 | Event when settings are changed
|
||||
1121 | Event when an attack surface reduction rule fires in audit mode
|
||||
1122 | Event when an attack surface reduction rule fires in block mode
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 09/18/2018
|
||||
ms.date: 04/02/2019
|
||||
---
|
||||
|
||||
|
||||
@ -37,32 +37,13 @@ You can use Group Policy, PowerShell, and configuration service providers (CSPs)
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work.
|
||||
|
||||
|
||||
|Audit options | How to enable audit mode | How to view events |
|
||||
|- | - | - |
|
||||
|Audit applies to all events | [Enable controlled folder access](enable-controlled-folders-exploit-guard.md) | [Controlled folder access events](evaluate-controlled-folder-access.md#review-controlled-folder-access-events-in-windows-event-viewer) |
|
||||
|Audit applies to individual rules | [Enable attack surface reduction rules](enable-attack-surface-reduction.md) | [Attack surface reduction rule events](evaluate-attack-surface-reduction.md#review-attack-surface-reduction-events-in-windows-event-viewer) |
|
||||
|Audit applies to all events | [Enable network protection](enable-network-protection.md) | [Network protection events](evaluate-network-protection.md#review-network-protection-events-in-windows-event-viewer) |
|
||||
|Audit applies to individual mitigations | [Enable exploit protection](enable-exploit-protection.md) | [Exploit protection events](exploit-protection-exploit-guard.md#review-exploit-protection-events-in-windows-event-viewer) |
|
||||
|
||||
Audit options | How to enable audit mode | How to view events
|
||||
- | - | -
|
||||
Audit applies to all events | [Enable controlled folder access](enable-controlled-folders-exploit-guard.md) | [Controlled folder access events](evaluate-controlled-folder-access.md#review-controlled-folder-access-events-in-windows-event-viewer)
|
||||
Audit applies to individual rules | [Enable attack surface reduction rules](enable-attack-surface-reduction.md) | [Attack surface reduction rule events](attack-surface-reduction-exploit-guard.md#review-attack-surface-reduction-events-in-windows-event-viewer)
|
||||
Audit applies to all events | [Enable network protection](enable-network-protection.md) | [Network protection events](evaluate-network-protection.md#review-network-protection-events-in-windows-event-viewer)
|
||||
Audit applies to individual mitigations | [Enable exploit protection](enable-exploit-protection.md) | [Exploit protection events](exploit-protection-exploit-guard.md#review-exploit-protection-events-in-windows-event-viewer)
|
||||
|
||||
|
||||
You can also use the a custom PowerShell script that enables the features in audit mode automatically:
|
||||
|
||||
1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *Enable-ExploitGuardAuditMode.ps1* to an easily accessible location on the machine.
|
||||
|
||||
1. Type **powershell** in the Start menu.
|
||||
|
||||
2. Right-click **Windows PowerShell**, click **Run as administrator** and click **Yes** or enter admin credentials at the prompt.
|
||||
|
||||
3. Enter the following in the PowerShell window to enable Controlled folder access and Attack surface reduction in audit mode:
|
||||
```PowerShell
|
||||
Set-ExecutionPolicy Bypass -Force
|
||||
<location>\Enable-ExploitGuardAuditMode.ps1
|
||||
```
|
||||
|
||||
Replace \<location> with the folder path where you placed the file.
|
||||
|
||||
A message should appear to indicate that audit mode was enabled.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -1,65 +0,0 @@
|
||||
---
|
||||
title: Submit cab files related to problems
|
||||
description: Use the command-line tool to obtain .cab file that can be used to investigate ASR rule issues.
|
||||
keywords: troubleshoot, error, fix, asr, windows defender eg, exploit guard, attack surface reduction
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 08/08/2018
|
||||
---
|
||||
|
||||
# Collect diagnostic data for file submissions
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
This topic describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using attack surface reduction rules, network protection, exploit protection, and controlled folder access.
|
||||
|
||||
In particular, you will be asked to collect and attach this data when using the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) if you indicate that you have encountered a problem with [attack surface reduction rules](attack-surface-reduction-exploit-guard.md) or [network protection](network-protection-exploit-guard.md).
|
||||
|
||||
Before attempting this process, ensure you have met all required pre-requisites and taken any other suggested troubleshooting steps as described in these topics:
|
||||
- [Troubleshoot attack surface reduction rules](troubleshoot-asr.md)
|
||||
- [Troubleshoot network protection](troubleshoot-np.md)
|
||||
|
||||
|
||||
|
||||
1. On the endpoint with the issue, obtain the Windows Defender .cab diagnostic file by following this process:
|
||||
|
||||
1. Open an administrator-level version of the command prompt:
|
||||
|
||||
1. Open the **Start** menu.
|
||||
|
||||
2. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**.
|
||||
|
||||
3. Enter administrator credentials or approve the prompt.
|
||||
|
||||
2. Navigate to the Windows Defender directory. By default, this is C:\Program Files\Windows Defender, as in the following example:
|
||||
|
||||
```console
|
||||
cd c:\program files\windows defender
|
||||
```
|
||||
|
||||
3. Enter the following command and press **Enter**
|
||||
|
||||
```console
|
||||
mpcmdrun -getfiles
|
||||
```
|
||||
|
||||
4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt, but by default it will be in C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab.
|
||||
|
||||
2. Attach this .cab file to the submission form where indicated.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Troubleshoot attack surface reduction rules](troubleshoot-asr.md)
|
||||
- [Troubleshoot network protection](troubleshoot-np.md)
|
||||
|
||||
|
||||
@ -36,6 +36,9 @@ You can exclude files and folders from being evaluated by most attack surface re
|
||||
|
||||
You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules the exclusions apply to.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly.
|
||||
|
||||
ASR rules support environment variables and wildcards. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists).
|
||||
|
||||
The following procedures for enabling ASR rules include instructions for how to exclude files and folders.
|
||||
@ -176,3 +179,4 @@ Value: c:\path|e:\path|c:\Whitelisted.exe
|
||||
|
||||
- [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction-exploit-guard.md)
|
||||
- [Evaluate attack surface reduction](evaluate-attack-surface-reduction.md)
|
||||
- [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus)
|
||||
|
||||
@ -11,6 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/29/2019
|
||||
---
|
||||
|
||||
# Enable controlled folder access
|
||||
@ -21,11 +22,15 @@ ms.author: v-anbic
|
||||
|
||||
[Controlled folder access](controlled-folders-exploit-guard.md) helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients.
|
||||
|
||||
This topic describes how to enable Controlled folder access with the Windows Security app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs).
|
||||
You can enable controlled folder access by using any of the these methods:
|
||||
|
||||
## Enable and audit controlled folder access
|
||||
- Windows Security app
|
||||
- Intune
|
||||
- MDM
|
||||
- Group Policy
|
||||
- PowerShell cmdlets
|
||||
|
||||
You can enable controlled folder access with the Security Center app, Group Policy, PowerShell, or MDM CSPs. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine.
|
||||
Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine.
|
||||
|
||||
>[!NOTE]
|
||||
>The Controlled folder access feature will display the state in the Windows Security app under **Virus & threat protection settings**.
|
||||
@ -38,7 +43,7 @@ You can enable controlled folder access with the Security Center app, Group Poli
|
||||
>- System Center Endpoint Protection **Allow users to add exclusions and overrides**
|
||||
>For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged).
|
||||
|
||||
## Windows Security app to enable controlled folder access
|
||||
## Windows Security app
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
@ -46,8 +51,23 @@ You can enable controlled folder access with the Security Center app, Group Poli
|
||||
|
||||
3. Set the switch for **Controlled folder access** to **On**.
|
||||
|
||||
## Intune
|
||||
|
||||
### Use Group Policy to enable Controlled folder access
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
|
||||
1. Click **Device configuration** > **Profiles** > **Create profile**.
|
||||
1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
|
||||
|
||||
1. Click **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**.
|
||||
1. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click **Add**.
|
||||
|
||||
1. Click **OK** to save each open blade and click **Create**.
|
||||
1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
|
||||
|
||||
## MDM
|
||||
|
||||
Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-controlledfolderaccessprotectedfolders) configuration service provider (CSP) to allow apps to make changes to protected folders.
|
||||
|
||||
## Group Policy
|
||||
|
||||
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
@ -65,7 +85,7 @@ You can enable controlled folder access with the Security Center app, Group Poli
|
||||
>[!IMPORTANT]
|
||||
>To fully enable controlled folder access, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu.
|
||||
|
||||
### Use PowerShell to enable controlled folder access
|
||||
## PowerShell
|
||||
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**.
|
||||
|
||||
@ -79,10 +99,6 @@ You can enable the feature in audit mode by specifying `AuditMode` instead of `E
|
||||
|
||||
Use `Disabled` to turn the feature off.
|
||||
|
||||
### Use MDM CSPs to enable controlled folder access
|
||||
|
||||
Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-controlledfolderaccessprotectedfolders) configuration service provider (CSP) to allow apps to make changes to protected folders.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md)
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/26/2019
|
||||
ms.date: 03/29/2019
|
||||
---
|
||||
|
||||
# Enable exploit protection
|
||||
@ -26,17 +26,22 @@ Many features from the Enhanced Mitigation Experience Toolkit (EMET) are include
|
||||
|
||||
You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Audit mode allows you to test how the mitigations would work (and review events) without impacting the normal use of the machine.
|
||||
|
||||
## Enable exploit protection
|
||||
You can enable each mitigation separately by using any of the these methods:
|
||||
|
||||
- Windows Security app
|
||||
- Intune
|
||||
- MDM
|
||||
- Group Policy
|
||||
- PowerShell cmdlets
|
||||
|
||||
You enable and configure each exploit protection mitigation separately either by using the Windows Security app or PowerShell.
|
||||
They are configured by default in Windows 10.
|
||||
|
||||
You can set each mitigation to on, off, or to its default value.
|
||||
Some mitigations have additional options.
|
||||
|
||||
You can [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) and deploy it to other machines by using Group Policy.
|
||||
You can [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) and deploy them to other machines.
|
||||
|
||||
### Windows Security app
|
||||
## Windows Security app
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
@ -103,9 +108,33 @@ CFG will be enabled for *miles.exe*.
|
||||
|
||||
5. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration.
|
||||
|
||||
## Intune
|
||||
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
|
||||
1. Click **Device configuration** > **Profiles** > **Create profile**.
|
||||
1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
|
||||
|
||||
1. Click **Configure** > **Windows Defender Exploit Guard** > **Exploit protection**.
|
||||
1. Upload an [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) with the exploit protection settings:
|
||||
|
||||
1. Click **OK** to save each open blade and click **Create**.
|
||||
1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
|
||||
|
||||
### PowerShell
|
||||
## MDM
|
||||
|
||||
Use the [./Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) configuration service provider (CSP) to enable or disable exploit protection mitigations or to use audit mode.
|
||||
|
||||
## Group Policy
|
||||
|
||||
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
1. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
||||
|
||||
1. Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit Protection** > **Use a common set of exploit protection settings**.
|
||||
|
||||
6. Click **Enabled** and type the location of the [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) and click **OK**.
|
||||
|
||||
## PowerShell
|
||||
|
||||
You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app:
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Turn network protection on
|
||||
title: Turn on network protection
|
||||
description: Enable Network protection with Group Policy, PowerShell, or MDM CSPs
|
||||
keywords: ANetwork protection, exploits, malicious website, ip, domain, domains, enable, turn on
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/27/2019
|
||||
ms.date: 04/01/2019
|
||||
---
|
||||
|
||||
# Enable network protection
|
||||
@ -24,18 +24,36 @@ ms.date: 03/27/2019
|
||||
You can [audit network protection](evaluate-network-protection.md) in a test environment to see which apps would be blocked before you enable it.
|
||||
You can enable network protection by using any of the these methods:
|
||||
|
||||
- Intune
|
||||
- MDM
|
||||
- Group Policy
|
||||
- PowerShell cmdlets
|
||||
- Registry
|
||||
|
||||
## Intune
|
||||
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
|
||||
1. Click **Device configuration** > **Profiles** > **Create profile**.
|
||||
1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
|
||||
|
||||
1. Click **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**.
|
||||
|
||||
1. Click **OK** to save each open blade and click **Create**.
|
||||
1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
|
||||
|
||||
## MDM
|
||||
|
||||
Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable and configure network protection.
|
||||
Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable or disable network protection or enable audit mode.
|
||||
|
||||
## Group Policy
|
||||
|
||||
1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
You can use the following procedure to enable network protection on a standalone computer or for domain-joined computers.
|
||||
|
||||
1. On a standalone computer, click **Start**, type and then click **Edit group policy**.
|
||||
|
||||
-Or-
|
||||
|
||||
On a domain-joined Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
||||
|
||||
@ -46,10 +64,17 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://d
|
||||
- **Disable (Default)** - The Network protection feature will not work. Users will not be blocked from accessing malicious domains
|
||||
- **Audit Mode** - If a user visits a malicious IP address or domain, an event will be recorded in the Windows event log but the user will not be blocked from visiting the address.
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
>To fully enable network protection, you must set the Group Policy option to **Enabled** and also select **Block** in the options drop-down menu.
|
||||
|
||||
You can confirm network protection is enabled on a local computer by using Registry editor:
|
||||
|
||||
1. Click **Start** and type **regedit** to open **Registry Editor**.
|
||||
1. Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection
|
||||
1. Click **EnableNetworkProtection** and confirm the value:
|
||||
- 0=Off
|
||||
- 1=On
|
||||
- 2=Audit
|
||||
|
||||
## PowerShell
|
||||
|
||||
@ -68,8 +93,13 @@ Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
|
||||
Use `Disabled` insead of `AuditMode` or `Enabled` to turn the feature off.
|
||||
|
||||
##
|
||||
|
||||
Network protection can't be turned on using the Windows Security app, but you can enable it by
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Protect your network](network-protection-exploit-guard.md)
|
||||
- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
|
||||
- [Network protection](network-protection-exploit-guard.md)
|
||||
- [Evaluate network protection](evaluate-network-protection.md)
|
||||
- [Troubleshoot network protection](troubleshoot-np.md)
|
||||
|
||||
@ -10,7 +10,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 03/15/2019
|
||||
ms.date: 04/01/2019
|
||||
---
|
||||
|
||||
# Enable virtualization-based protection of code integrity
|
||||
@ -28,7 +28,7 @@ If this happens, see [Troubleshooting](#troubleshooting) for remediation steps.
|
||||
>HVCI works with modern 7th gen CPUs or higher and its equivalent on AMD. CPU new feature is required *Mode based execution control (MBE) Virtualization*.
|
||||
|
||||
>[!TIP]
|
||||
> "The Secure Kernel relies on the Mode-Based Execution Control (MBEC) feature, if present in hardware, which enhances the SLAT with a user/kernel executable bit, or the hypervisor’s software emulation of this feature, called Restricted User Mode (RUM).". Mark Russinovich and Alex Ionescu. Windows Internals 7th Edition book
|
||||
> "The Secure Kernel relies on the Mode-Based Execution Control (MBEC) feature, if present in hardware, which enhances the SLAT with a user/kernel executable bit, or the hypervisor’s software emulation of this feature, called Restricted User Mode (RUM)." Mark Russinovich and Alex Ionescu. Windows Internals 7th Edition book
|
||||
|
||||
## HVCI Features
|
||||
|
||||
@ -291,6 +291,6 @@ Set-VMSecurity -VMName <VMName> -VirtualizationBasedSecurityOptOut $true
|
||||
### Requirements for running HVCI in Hyper-V virtual machines
|
||||
- The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607.
|
||||
- The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10.
|
||||
- HVCI and [virtualization](https://docs.microsoft.com/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time
|
||||
- HVCI and [nested virtualization](https://docs.microsoft.com/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time
|
||||
- Virtual Fibre Channel adapters are not compatible with HVCI. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of virtualization-based security using `Set-VMSecurity`.
|
||||
- The AllowFullSCSICommandSet option for pass-through disks is not compatible with HVCI. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of virtualization-based security using `Set-VMSecurity`.
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 11/16/2018
|
||||
ms.date: 04/02/2019
|
||||
---
|
||||
|
||||
# Evaluate attack surface reduction rules
|
||||
@ -45,6 +45,17 @@ This enables all attack surface reduction rules in audit mode.
|
||||
>If you want to fully audit how attack surface reduction rules will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s).
|
||||
You can also use Group Policy, Intune, or MDM CSPs to configure and deploy the setting, as described in the main [Attack surface reduction rules topic](attack-surface-reduction-exploit-guard.md).
|
||||
|
||||
## Review attack surface reduction events in Windows Event Viewer
|
||||
|
||||
To review apps that would have been blocked, open Event Viewer and filter for Event ID 1121 in the Microsoft-Windows-Windows-Defender/Operational log. The following table lists all network protection events.
|
||||
|
||||
|
||||
| Event ID | Description |
|
||||
|----------|-------------|
|
||||
|5007 | Event when settings are changed |
|
||||
| 1121 | Event when an attack surface reduction rule fires in audit mode |
|
||||
| 1122 | Event when an attack surface reduction rule fires in block mode |
|
||||
|
||||
## Customize attack surface reduction rules
|
||||
|
||||
During your evaluation, you may wish to configure each rule individualy or exclude certain files and processes from being evaluated by the feature.
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/26/2019
|
||||
ms.date: 04/02/2019
|
||||
---
|
||||
|
||||
# Evaluate exploit protection
|
||||
@ -109,6 +109,7 @@ Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 11 | Code in
|
||||
- [Enable exploit protection](enable-exploit-protection.md)
|
||||
- [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
|
||||
- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md)
|
||||
- [Troubleshoot exploit protection](troubleshoot-exploit-protection-mitigations.md)
|
||||
- [Enable network protection](enable-network-protection.md)
|
||||
- [Enable controlled folder access](enable-controlled-folders-exploit-guard.md)
|
||||
- [Enable attack surface reduction](enable-attack-surface-reduction.md)
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 11/16/2018
|
||||
ms.date: 04/02/2019
|
||||
---
|
||||
|
||||
# Evaluate network protection
|
||||
@ -20,75 +20,51 @@ ms.date: 11/16/2018
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Network protection helps prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
|
||||
[Network protection](network-protection-exploit-guard.md) helps prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
|
||||
|
||||
This topic helps you evaluate Network protection by enabling the feature and guiding you to a testing site.
|
||||
This topic helps you evaluate Network protection by enabling the feature and guiding you to a testing site. The site in this evaluation topic are not malicious, they are specially created websites that pretend to be malicious. The site will replicate the behavior that would happen if a user visted a malicious site or domain.
|
||||
|
||||
>[!NOTE]
|
||||
>The site will replicate the behavior that would happen if a user visted a malicious site or domain. The sites in this evaluation topic are not malicious, they are specially created websites that pretend to be malicious.
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how other protection features work.
|
||||
|
||||
## Enable network protection
|
||||
## Enable network protection in audit mode
|
||||
|
||||
You can enable network protection in audit mode to see which IP addresses and domains would have been blocked if it was enabled.
|
||||
|
||||
You might want to do this to make sure it doesn't affect line-of-business apps or to get an idea of how often blocks occur.
|
||||
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
|
||||
2. Enter the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -EnableNetworkProtection Enabled
|
||||
Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
```
|
||||
|
||||
You can also carry out the processes described in this topic in audit or disabled mode to see how the feature will work. Use the same PowerShell cmdlet as above, but replace "Enabled" with either "AuditMode" or "Disabled".
|
||||
|
||||
### Visit a (fake) malicious domain
|
||||
|
||||
1. Open Internet Explorer, Google Chrome, or any other browser of your choice.
|
||||
|
||||
1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net).
|
||||
|
||||
You will get a 403 Forbidden response in the browser, and you will see a notification that the network connnection was blocked.
|
||||
The network connection will be allowed and a test message will be displayed.
|
||||
|
||||
|
||||
|
||||
## Review network protection events in Windows Event Viewer
|
||||
|
||||
You can also review the Windows event log to see the events there were created when performing the demo. You can use the custom view below or [locate them manually](event-views-exploit-guard.md#list-of-attack-surface-reduction-events).
|
||||
To review apps that would have been blocked, open Event Viewer and filter for Event ID 1125 in the Microsoft-Windows-Windows-Defender/Operational log. The following table lists all network protection events.
|
||||
|
||||
1. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
|
||||
| Event ID | Provide/Source | Description |
|
||||
|-|-|-|
|
||||
|5007 | Windows Defender (Operational) | Event when settings are changed |
|
||||
|1125 | Windows Defender (Operational) | Event when a network connection is audited |
|
||||
|1126 | Windows Defender (Operational) | Event when a network connection is blocked |
|
||||
|
||||
2. On the left panel, under **Actions**, click **Import custom view...**
|
||||
|
||||
3. Navigate to the Exploit Guard Evaluation Package, and select the file *np-events.xml*. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
|
||||
|
||||
4. Click **OK**.
|
||||
|
||||
5. This will create a custom view that filters to only show the following events related to network protection:
|
||||
|
||||
Event ID | Description
|
||||
-|-
|
||||
5007 | Event when settings are changed
|
||||
1125 | Event when rule fires in audit mode
|
||||
1126 | Event when rule fires in block mode
|
||||
|
||||
|
||||
## Use audit mode to measure impact
|
||||
|
||||
You can also enable the network protection feature in audit mode. This lets you see a record of which IP addresses and domains would have been blocked if the feature were enabled.
|
||||
|
||||
You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how often the feature will block connections during normal use.
|
||||
|
||||
To enable audit mode, use the following PowerShell cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
```
|
||||
>[!TIP]
|
||||
>If you want to fully audit how network protection will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s).
|
||||
You can also use Group Policy, Intune, or MDM CSPs to configure and deploy the setting, as described in the main [Network protection topic](network-protection-exploit-guard.md).
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Protect your network](network-protection-exploit-guard.md)
|
||||
- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md)
|
||||
- [Use audit mode to evaluate Windows Defender Exploit Guard](audit-windows-defender-exploit-guard.md)
|
||||
- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
|
||||
- [Network protection](network-protection-exploit-guard.md)
|
||||
- [Enable network protection](enable-network-protection.md)
|
||||
- [Troubleshoot network protection](troubleshoot-np.md)
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/26/2018
|
||||
ms.date: 04/02/2019
|
||||
---
|
||||
|
||||
# Protect devices from exploits
|
||||
@ -154,5 +154,6 @@ Validate image dependency integrity | [!include[Check mark yes](images/svg/check
|
||||
- [Enable exploit protection](enable-exploit-protection.md)
|
||||
- [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
|
||||
- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md)
|
||||
- [Troubleshoot exploit protection](troubleshoot-exploit-protection-mitigations.md)
|
||||
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 78 KiB After Width: | Height: | Size: 56 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 78 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
@ -53,17 +53,11 @@ You can query Windows Defender ATP data by using [Advanced hunting](https://docs
|
||||
|
||||
You can review the Windows event log to see events that are created when network protection blocks (or audits) access to a malicious IP or domain:
|
||||
|
||||
1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *np-events.xml* to an easily accessible location on the machine.
|
||||
1. [Copy the XML directly](event-views-exploit-guard.md).
|
||||
|
||||
1. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
|
||||
2. Click **OK**.
|
||||
|
||||
2. On the left panel, under **Actions**, click **Import custom view...**
|
||||
|
||||
3. Navigate to the Exploit Guard Evaluation Package, and select the file *np-events.xml*. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
|
||||
|
||||
4. Click **OK**.
|
||||
|
||||
5. This will create a custom view that filters to only show the following events related to network protection:
|
||||
3. This will create a custom view that filters to only show the following events related to network protection:
|
||||
|
||||
Event ID | Description
|
||||
-|-
|
||||
|
||||
@ -11,6 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/27/2019
|
||||
---
|
||||
|
||||
# Troubleshoot attack surface reduction rules
|
||||
@ -26,12 +27,12 @@ When you use [attack surface reduction rules](attack-surface-reduction-exploit-g
|
||||
|
||||
There are four steps to troubleshooting these problems:
|
||||
|
||||
1. Confirm that you have met all pre-requisites
|
||||
1. Confirm prerequisites
|
||||
2. Use audit mode to test the rule
|
||||
3. Add exclusions for the specified rule (for false positives)
|
||||
3. Submit support logs
|
||||
|
||||
## Confirm pre-requisites
|
||||
## Confirm prerequisites
|
||||
|
||||
Attack surface reduction rules will only work on devices with the following conditions:
|
||||
|
||||
@ -45,27 +46,14 @@ If these pre-requisites have all been met, proceed to the next step to test the
|
||||
|
||||
## Use audit mode to test the rule
|
||||
|
||||
There are two ways that you can test if the rule is working.
|
||||
You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm attack surface reduction rules are generally working for pre-configured scenarios and processes on a device, or you can use audit mode, which enables rules for reporting only.
|
||||
|
||||
You can use a pre-configured demo tool to confirm attack surface reduction rules are generally working on the device, or you can use audit mode, which enables rules for reporting only.
|
||||
Follow these instructions in [Use the demo tool to see how attack surface reduction rules work](evaluate-attack-surface-reduction.md) to test the specific rule you are encountering problems with.
|
||||
|
||||
The demo tool uses pre-configured scenarios and processes, which can be useful to first see if the attack surface reduction rule feature as a whole is operating correctly.
|
||||
|
||||
If you encounter problems when running the demo tool, check that the device you are testing the tool on meets the [pre-requisites listed above](#confirm-pre-requisites).
|
||||
|
||||
Follow the instructions in [Use the demo tool to see how attack surface reduction rules work](evaluate-attack-surface-reduction.md) to test the specific rule you are encountering problems with.
|
||||
|
||||
>[!TIP]
|
||||
>While the instructions for using the demo tool are intended for evaluating or seeing how attack surface reduction rules work, you can use it to test that the rule works on known scenarios that we have already extensively tested before we released the feature.
|
||||
|
||||
Audit mode allows the rule to report as if it actually blocked the file or process, but will still allow the file to run.
|
||||
|
||||
1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
|
||||
1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). Audit mode allows the rule to report the file or process, but will still allow it to run.
|
||||
2. Perform the activity that is causing an issue (for example, open or execute the file or process that should be blocked but is being allowed).
|
||||
3. [Review the attack surface reductio rule event logs](attack-surface-reduction-exploit-guard.md) to see if the rule would have blocked the file or process if the rule had been set to **Enabled**.
|
||||
|
||||
>[!TIP]
|
||||
>Audit mode will stop the rule from blocking the file or process.
|
||||
>
|
||||
>If a rule is not blocking a file or process that you are expecting it should block, first check if audit mode is enabled.
|
||||
>
|
||||
@ -74,36 +62,39 @@ Audit mode allows the rule to report as if it actually blocked the file or proce
|
||||
If you've tested the rule with the demo tool and with audit mode, and attack surface reduction rules are working on pre-configured scenarios, but the rule is not working as expected, proceed to either of the following sections based on your situation:
|
||||
|
||||
1. If the attack surface reduction rule is blocking something that it should not block (also known as a false positive), you can [first add an attack surface reduction rule exclusion](#add-exclusions-for-a-false-positive).
|
||||
2. If the attack surface reduction rule is not blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data).
|
||||
2. If the attack surface reduction rule is not blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data-for-file-submissions).
|
||||
|
||||
## Add exclusions for a false positive
|
||||
|
||||
You can add exclusions to prevent attack surface reduction rules from evaluating the excluded files or folders.
|
||||
If the attack surface reduction rule is blocking something that it should not block (also known as a false positive), you can add exclusions to prevent attack surface reduction rules from evaluating the excluded files or folders.
|
||||
|
||||
This is useful if you have enabled a rule, and it is blocking a file, process, or action that you believe it should not block. You can then collect data from an endpoint where the rule is not working correctly and send that information to us.
|
||||
|
||||
To add an exclusion, see the [Customize Attack surface reduction](customize-attack-surface-reduction.md) topic.
|
||||
To add an exclusion, see [Customize Attack surface reduction](customize-attack-surface-reduction.md).
|
||||
|
||||
>[!IMPORTANT]
|
||||
>You can specify individual files and folders to be excluded, but you cannot specify individual rules.
|
||||
>
|
||||
>This means any files or folders that are excluded will be excluded from all ASR rules.
|
||||
|
||||
If you have followed all previous troubleshooting steps, and you still have a problem (in particular, if you have a false positive), you should proceed to the next step to collect diagnostic information and send it to us.
|
||||
## Report a false positive or false negative
|
||||
|
||||
## Collect diagnostic data
|
||||
Use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also [provide a link to any associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
You can use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a problem with attack surface reduction rules.
|
||||
## Collect diagnostic data for file submissions
|
||||
|
||||
When you fill out the submission form, you will be asked to specify whether it is a false negative or false positive. If you have an E5 subscription for Windows Defender Advanced Threat Protection, you can also [provide a link to the associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) (if there is one).
|
||||
When you report a problem with attack surface reduction rules, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues.
|
||||
|
||||
You must also attach associated files in a .zip file (such as the file or executable that is not being blocked, or being incorrectly blocked) along with a diagnostic .cab file to your submission.
|
||||
|
||||
Follow the link below for instructions on how to collect the .cab file:
|
||||
|
||||
> [!div class="nextstepaction"]
|
||||
> [Collect and submit diagnostic data](collect-cab-files-exploit-guard-submission.md)
|
||||
1. Open an elevated command prompt and change to the Windows Defender directory:
|
||||
```console
|
||||
cd c:\program files\windows defender
|
||||
```
|
||||
2. Run this command to generate the diagnostic logs:
|
||||
```console
|
||||
mpcmdrun -getfiles
|
||||
```
|
||||
3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md)
|
||||
- [Enable attack surface reduction rules](enable-attack-surface-reduction.md)
|
||||
- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md)
|
||||
|
||||
|
||||
@ -29,12 +29,12 @@ When you use [Network protection](network-protection-exploit-guard.md) you may e
|
||||
|
||||
There are four steps to troubleshooting these problems:
|
||||
|
||||
1. Confirm that you have met all pre-requisites
|
||||
1. Confirm prerequisites
|
||||
2. Use audit mode to test the rule
|
||||
3. Add exclusions for the specified rule (for false positives)
|
||||
3. Submit support logs
|
||||
|
||||
## Confirm pre-requisites
|
||||
## Confirm prerequisites
|
||||
|
||||
Network protection will only work on devices with the following conditions:
|
||||
|
||||
@ -45,48 +45,45 @@ Network protection will only work on devices with the following conditions:
|
||||
> - [Cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) is enabled.
|
||||
> - Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**).
|
||||
|
||||
If these pre-requisites have all been met, proceed to the next step to test the rule in audit mode.
|
||||
|
||||
## Use audit mode to test the rule
|
||||
## Use audit mode
|
||||
|
||||
There are two ways that you can test if the feature is working - you can use a demo website, and you can use audit mode.
|
||||
You can enable network protection in audit mode and then visit a website that we've created to demo the feature. All website connections will be allowed by network protection but an event will be logged to indicate any connection that would have been blocked if network protection was enabled.
|
||||
|
||||
You can enable network protection and then visit a website that we've created to demo the feature. The website will always be reported as blocked by network protection. See [Evaluate network protection](evaluate-network-protection.md) for instructions.
|
||||
|
||||
If you encounter problems when running the evaluation scenario, check that the device you are testing the tool on meets the [pre-requisites listed above](#confirm-pre-requisites).
|
||||
|
||||
>[!TIP]
|
||||
>While the instructions for using the demo website are intended for evaluating or seeing how network protection works, you can use it to test that the feature is working properly and narrow down on the cause of the problem.
|
||||
|
||||
You can also use audit mode and then attempt to visit the site or IP (IPv4) address you do or don't want to block. Audit mode lets network protection report to the Windows event log as if it actually blocked the site or connection to an IP address, but will still allow the file to run.
|
||||
|
||||
1. Enable audit mode for network protection. Use Group Policy to set the rule to **Audit mode** as described in the [Enable network protection topic](enable-network-protection.md#group-policy).
|
||||
1. Set network protection to **Audit mode**.
|
||||
```powershell
|
||||
Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
```
|
||||
2. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block).
|
||||
3. [Review the network protection event logs](network-protection-exploit-guard.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**.
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Audit mode will stop network protection from blocking known malicious connections.
|
||||
>
|
||||
>If network protection is not blocking a connection that you are expecting it should block, first check if audit mode is enabled.
|
||||
>
|
||||
>Audit mode may have been enabled for testing another feature in Windows Defender Exploit Guard, or by an automated PowerShell script, and may not have been disabled after the tests were completed.
|
||||
>If network protection is not blocking a connection that you are expecting it should block, enable the feature.
|
||||
|
||||
|
||||
If you've tested the feature with the demo site and with audit mode, and network protection is working on pre-configured scenarios, but is not working as expected for a specific connection, proceed to the next section to report the site or IP address.
|
||||
```powershell
|
||||
Set-MpPreference -EnableNetworkProtection Enabled
|
||||
```
|
||||
|
||||
## Report a false positive or false negative
|
||||
|
||||
You can use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a problem with network protection.
|
||||
If you've tested the feature with the demo site and with audit mode, and network protection is working on pre-configured scenarios, but is not working as expected for a specific connection, use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also [provide a link to any associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
When you fill out the submission form, you will be asked to specify whether it is a false negative or false positive. If you have an E5 subscription for Windows Defender Advanced Threat Protection, you can also [provide a link to the associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) (if there is one).
|
||||
## Collect diagnostic data for file submissions
|
||||
|
||||
You can also attach a diagnostic .cab file to your submission if you wish (this is not required). Follow the link below for instructions on how to collect the .cab file:
|
||||
When you report a problem with network protection, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues.
|
||||
|
||||
> [!div class="nextstepaction"]
|
||||
> [Collect and submit diagnostic data Windows Defender Exploit Guard issues](collect-cab-files-exploit-guard-submission.md)
|
||||
1. Open an elevated command prompt and change to the Windows Defender directory:
|
||||
```console
|
||||
cd c:\program files\windows defender
|
||||
```
|
||||
2. Run this command to generate the diagnostic logs:
|
||||
```console
|
||||
mpcmdrun -getfiles
|
||||
```
|
||||
3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
|
||||
- [Network protection](network-protection-exploit-guard.md)
|
||||
- [Evaluate network protection](evaluate-network-protection.md)
|
||||
- [Enable network protection](enable-network-protection.md)
|
||||
|
||||
@ -12,7 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 04/02/2019
|
||||
---
|
||||
|
||||
# Assign Security Group Filters to the GPO
|
||||
@ -23,7 +23,8 @@ ms.date: 04/19/2017
|
||||
|
||||
To make sure that your GPO is applied to the correct computers, use the Group Policy Management MMC snap-in to assign security group filters to the GPO.
|
||||
|
||||
>**Important:** This deployment guide uses the method of adding the Domain Computers group to the membership group for the main isolated domain after testing is complete and you are ready to go live in production. To make this method work, you must prevent any computer that is a member of either the boundary or encryption zone from applying the GPO for the main isolated domain. For example, on the GPOs for the main isolated domain, deny Read and Apply Group Policy permissions to the membership groups for the boundary and encryption zones.
|
||||
>[!IMPORTANT]
|
||||
>This deployment guide uses the method of adding the Domain Computers group to the membership group for the main isolated domain after testing is complete and you are ready to go live in production. To make this method work, you must prevent any computer that is a member of either the boundary or encryption zone from applying the GPO for the main isolated domain. For example, on the GPOs for the main isolated domain, deny Read and Apply Group Policy permissions to the membership groups for the boundary and encryption zones.
|
||||
|
||||
|
||||
|
||||
@ -47,7 +48,8 @@ Use the following procedure to add a group to the security filter on the GPO tha
|
||||
|
||||
3. In the details pane, under **Security Filtering**, click **Authenticated Users**, and then click **Remove**.
|
||||
|
||||
>**Note:** You must remove the default permission granted to all authenticated users and computers to restrict the GPO to only the groups you specify.
|
||||
>[!NOTE]
|
||||
>You must remove the default permission granted to all authenticated users and computers to restrict the GPO to only the groups you specify. If the GPO contains User settings, and the **Authenticated Users** group is removed, and new security filtering is added using a security group that only contains user accounts, the GPO can fail to apply. Details and various workarounds are mentioned in this [Microsoft blog](https://techcommunity.microsoft.com/t5/Core-Infrastructure-and-Security/Who-broke-my-user-GPOs/ba-p/258781).
|
||||
|
||||
4. Click **Add**.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user