mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-29 13:47:23 +00:00
Merge branch 'public' into repo_sync_working_branch
This commit is contained in:
Daniel Simpson
GitHub
commit
ea36b48f0a
@ -105,13 +105,12 @@ Here are some things you can try saying (remember to say "Hey Cortana" first).
|
||||
- Take a picture.
|
||||
- Start recording. (Starts recording a video.)
|
||||
- Stop recording. (Stops recording a video.)
|
||||
- Call <*contact*>. (Requires Skype.)
|
||||
- What time is it?
|
||||
- Show me the latest NBA scores.
|
||||
- How much battery do I have left?
|
||||
- Tell me a joke.
|
||||
|
||||
Some Cortana features that you're used to from Windows on your PC or phone (for example, reminders and notifications) aren't supported in Microsoft HoloLens Development Edition. Cortana on HoloLens is English-only, and the Cortana experience may vary from one region to another.
|
||||
Some Cortana features that you're used to from Windows on your PC or phone (for example, reminders and notifications) aren't supported in Microsoft HoloLens, and the Cortana experience may vary from one region to another.
|
||||
|
||||
### Turn Cortana off
|
||||
|
||||
|
||||
@ -54,25 +54,26 @@ Instead of using the Microsoft Admin Center portal, you can create the account u
|
||||
|
||||
### Connect to Exchange Online PowerShell
|
||||
|
||||
```
|
||||
$365Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential (Get-Credential) -Authentication Basic –AllowRedirection $ImportResults = Import-PSSession $365Session
|
||||
```powershell
|
||||
$365Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential (Get-Credential) -Authentication Basic –AllowRedirection
|
||||
$ImportResults = Import-PSSession $365Session
|
||||
```
|
||||
|
||||
### Create a new Room Mailbox
|
||||
|
||||
```
|
||||
```powershell
|
||||
New-Mailbox -MicrosoftOnlineServicesID account@YourDomain.com -Alias SurfaceHub2S -Name SurfaceHub2S -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String "<Enter Strong Password>" -AsPlainText -Force)
|
||||
```
|
||||
|
||||
### Set Calendar Auto processing
|
||||
|
||||
```
|
||||
```powershell
|
||||
Set-CalendarProcessing -Identity "account@YourDomain.com" -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false -AddAdditionalResponse $true -AdditionalResponse "This room is equipped with a Surface Hub"
|
||||
```
|
||||
|
||||
### Assign a license
|
||||
|
||||
```
|
||||
```powershell
|
||||
Connect-MsolService
|
||||
Set-Msoluser -UserPrincipalName account@YourDomain.com -UsageLocation IE
|
||||
Set-MsolUserLicense -UserPrincipalName "account@YourDomain.com" -AddLicenses "contoso:MEETING_ROOM"
|
||||
@ -85,10 +86,11 @@ Set-MsolUserLicense -UserPrincipalName "account@YourDomain.com" -AddLicenses "co
|
||||
- [Visual C++ 2017 Redistributable](https://aka.ms/vs/15/release/vc_redist.x64.exe)
|
||||
- [Skype for Business Online PowerShell Module](https://www.microsoft.com/download/confirmation.aspx?id=39366)
|
||||
|
||||
```
|
||||
```powershell
|
||||
Import-Module LyncOnlineConnector
|
||||
$SfBSession = New-CsOnlineSession -Credential (Get-Credential)
|
||||
Import-PSSession $SfBSession -AllowClobber
|
||||
Enable the Skype for Business meeting room
|
||||
|
||||
# Enable the Skype for Business meeting room
|
||||
Enable-CsMeetingRoom -Identity account@YourDomain.com -RegistrarPool(Get-CsTenant).Registrarpool -SipAddressType EmailAddress
|
||||
```
|
||||
|
||||
@ -52,9 +52,11 @@ Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-gu
|
||||
|
||||
4. Enter **Authenticated Users**, then click **Check Names**. If the **Name Not Found** window opens, click **Locations** and select this PC.
|
||||
|
||||
>[!TIP]
|
||||
>When you connect to the remote PC, enter your account name in this format: `AzureAD UPN`. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant.
|
||||
> [!TIP]
|
||||
> When you connect to the remote PC, enter your account name in this format: `AzureAD UPN`. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant.
|
||||
|
||||
> [!Note]
|
||||
> If you cannot connect using Remote Desktop Connection 6.0, then you must turn off new features of RDP 6.0 and revert back to RDP 5.0 by changing a few changes in the RDP file. See the details in the [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e).
|
||||
|
||||
## Supported configurations
|
||||
|
||||
|
||||
@ -504,7 +504,7 @@ Supported operation is Get.
|
||||
|
||||
|
||||
|
||||
<a href="" id="appinstallation-packagefamilyname-lasterrordescription"></a>**AppInstallation/*PackageFamilyName*/LastErrorDescription**
|
||||
<a href="" id="appinstallation-packagefamilyname-lasterrordescription"></a>**AppInstallation/*PackageFamilyName*/LastErrorDesc**
|
||||
Required. Description of last error relating to the app installation.
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
@ -190,7 +190,7 @@ Default value is false. If you set this policy to true, Remote Windows Hello for
|
||||
|
||||
Supported operations are Add, Get, Delete, and Replace.
|
||||
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).*
|
||||
|
||||
<a href="" id="tenantid-policies-usehellocertificatesassmartcardcertificates"></a>***TenantId*/Policies/UseHelloCertificatesAsSmartCardCertificates** (only for ./Device/Vendor/MSFT)
|
||||
Added in Windows 10, version 1809. If you enable this policy setting, applications use Windows Hello for Business certificates as smart card certificates. Biometric factors are unavailable when a user is asked to authorize the use of the certificate's private key. This policy setting is designed to allow compatibility with applications that rely exclusively on smart card certificates.
|
||||
@ -206,7 +206,7 @@ This node is deprecated. Use **Biometrics/UseBiometrics** node instead.
|
||||
|
||||
<a href="" id="biometrics--only-for---device-vendor-msft-"></a>**Biometrics** (only for ./Device/Vendor/MSFT)
|
||||
Node for defining biometric settings. This node was added in Windows 10, version 1511.
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).*
|
||||
|
||||
<a href="" id="biometrics-usebiometrics--only-for---device-vendor-msft-"></a>**Biometrics/UseBiometrics** (only for ./Device/Vendor/MSFT)
|
||||
Boolean value used to enable or disable the use of biometric gestures, such as face and fingerprint, as an alternative to the PIN gesture for Windows Hello for Business. Users must still configure a PIN if they configure biometric gestures to use in case of failures. This node was added in Windows 10, version 1511.
|
||||
@ -230,7 +230,7 @@ Note that enhanced anti-spoofing for Windows Hello face authentication is not re
|
||||
|
||||
Supported operations are Add, Get, Delete, and Replace.
|
||||
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||
*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).*
|
||||
|
||||
<a href="" id="deviceunlock"></a>**DeviceUnlock** (only for ./Device/Vendor/MSFT)
|
||||
Added in Windows 10, version 1803. Interior node.
|
||||
|
||||
@ -53,5 +53,5 @@ Typically, the improvements are reliability and performance improvements that do
|
||||
* Servicing stack updates contain the full servicing stack; as a result, typically administrators only need to install the latest servicing stack update for the operating system.
|
||||
* Installing servicing stack update does not require restarting the device, so installation should not be disruptive.
|
||||
* Servicing stack update releases are specific to the operating system version (build number), much like quality updates.
|
||||
* Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001).
|
||||
* Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine.
|
||||
* Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001).
|
||||
* Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine.
|
||||
|
||||
@ -42,17 +42,17 @@ Two methods of peer-to-peer content distribution are available in Windows 10.
|
||||
| Delivery Optimization |  |  |  |  |
|
||||
| BranchCache |  |  | |  |
|
||||
|
||||
>[!NOTE]
|
||||
>System Center Configuration Manager has an additional feature called Client Peer Cache that allows peer-to-peer content sharing between clients you use System Center Configuration Manager to manage, in the same Configuration Manager boundary Group. For more information, see [Client Peer Cache](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/client-peer-cache).
|
||||
> [!NOTE]
|
||||
> System Center Configuration Manager has an additional feature called Client Peer Cache that allows peer-to-peer content sharing between clients you use System Center Configuration Manager to manage, in the same Configuration Manager boundary Group. For more information, see [Client Peer Cache](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/client-peer-cache).
|
||||
>
|
||||
>In addition to Client Peer Cache, similar functionality is available in the Windows Preinstallation Environment (Windows PE) for imaging-related content. Using this technology, clients imaging with System Center Configuration Manager task sequences can source operating system images, driver packages, boot images, packages, and programs from peers instead of distribution points. For detailed information about how Windows PE Peer Cache works and how to configure it, see [Prepare Windows PE peer cache to reduce WAN traffic in System Center Configuration Manager](https://technet.microsoft.com/library/mt613173.aspx).
|
||||
> In addition to Client Peer Cache, similar functionality is available in the Windows Preinstallation Environment (Windows PE) for imaging-related content. Using this technology, clients imaging with System Center Configuration Manager task sequences can source operating system images, driver packages, boot images, packages, and programs from peers instead of distribution points. For detailed information about how Windows PE Peer Cache works and how to configure it, see [Prepare Windows PE peer cache to reduce WAN traffic in System Center Configuration Manager](https://docs.microsoft.com/configmgr/osd/get-started/prepare-windows-pe-peer-cache-to-reduce-wan-traffic).
|
||||
|
||||
## Express update delivery
|
||||
|
||||
Windows 10 quality update downloads can be large because every package contains all previously released fixes to ensure consistency and simplicity. Windows has been able to reduce the size of Windows Update downloads with a feature called Express.
|
||||
|
||||
>[!NOTE]
|
||||
>Express update delivery applies to quality update downloads. Starting with Windows 10, version 1709, Express update delivery also applies to feature update downloads for clients connected to Windows Update and Windows Update for Business.
|
||||
> [!NOTE]
|
||||
> Express update delivery applies to quality update downloads. Starting with Windows 10, version 1709, Express update delivery also applies to feature update downloads for clients connected to Windows Update and Windows Update for Business.
|
||||
|
||||
### How Microsoft supports Express
|
||||
- **Express on System Center Configuration Manager** starting with version 1702 of Configuration Manager and Windows 10, version 1703 or later, or Windows 10, version 1607 with the April 2017 cumulative update.
|
||||
@ -81,8 +81,8 @@ The Windows Update client will try to download Express first, and under certain
|
||||
|
||||
At this point, the download is complete and the update is ready to be installed.
|
||||
|
||||
>[!TIP]
|
||||
>Express will **always** be leveraged if your machines are updated regularly with the latest cumulative updates.
|
||||
> [!TIP]
|
||||
> Express will **always** be leveraged if your machines are updated regularly with the latest cumulative updates.
|
||||
|
||||
## Steps to manage updates for Windows 10
|
||||
|
||||
@ -98,7 +98,6 @@ At this point, the download is complete and the update is ready to be installed.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
|
||||
@ -144,11 +144,11 @@ The Microsoft Data Management Service routes data back to our secure cloud stora
|
||||
|
||||
The following table defines the endpoints for Connected User Experiences and Telemetry component:
|
||||
|
||||
Windows release | Endpoint
|
||||
--- | ---
|
||||
Windows 10, versions 1703 or later, with the 2018-09 cumulative update installed| **Diagnostics data** - v10c.vortex-win.data.microsoft.com</br></br>**Functional** - v20.vortex-win.data.microsoft.com</br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com</br>**Settings** - win.data.microsoft.com
|
||||
Windows 10, versions 1803 or later, without the 2018-09 cumulative update installed | **Diagnostics data** - v10.events.data.microsoft.com</br></br>**Functional** - v20.vortex-win.data.microsoft.com</br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com</br>**Settings** - win.data.microsoft.com
|
||||
Windows 10, version 1709 or earlier | **Diagnostics data** - v10.vortex-win.data.microsoft.com</br></br>**Functional** - v20.vortex-win.data.microsoft.com</br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com</br>**Settings** - win.data.microsoft.com
|
||||
| Windows release | Endpoint |
|
||||
| ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
|
||||
| Windows 10, versions 1703 or later, with the 2018-09 cumulative update installed | **Diagnostics data:** v10c.vortex-win.data.microsoft.com</br></br>**Functional:** v20.vortex-win.data.microsoft.com</br></br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,</br>for example: **de**.vortex-win.data.microsoft.com</br></br>**Settings:** settings-win.data.microsoft.com |
|
||||
| Windows 10, versions 1803 or later, without the 2018-09 cumulative update installed | **Diagnostics data:** v10.events.data.microsoft.com</br></br>**Functional:** v20.vortex-win.data.microsoft.com</br></br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,</br>for example: **de**.vortex-win.data.microsoft.com</br></br>**Settings:** settings-win.data.microsoft.com |
|
||||
| Windows 10, version 1709 or earlier | **Diagnostics data:** v10.vortex-win.data.microsoft.com</br></br>**Functional:** v20.vortex-win.data.microsoft.com</br></br>**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,</br>for example: **de**.vortex-win.data.microsoft.com</br></br>**Settings:** settings-win.data.microsoft.com |
|
||||
|
||||
The following table defines the endpoints for other diagnostic data services:
|
||||
|
||||
@ -385,7 +385,7 @@ In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data
|
||||
|
||||
- **Some crash dump types.** Triage dumps for user mode and mini dumps for kernel mode.
|
||||
|
||||
>[!NOTE]
|
||||
> [!NOTE]
|
||||
> Triage dumps are a type of [minidumps](https://docs.microsoft.com/windows/desktop/debug/minidump-files) that go through a process of user-sensitive information scrubbing. Some user-sensitive information may be missed in the process, and will therefore be sent with the dump.
|
||||
|
||||
With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data.
|
||||
|
||||
@ -193,6 +193,9 @@ Sign-in the federation server with _domain administrator_ equivalent credentials
|
||||
|
||||
### Add the AD FS Service account to the KeyCredential Admin group and the Windows Hello for Business Users group
|
||||
|
||||
> [!NOTE]
|
||||
> If you have a Windows Server 2016 domain controller in your domain, you can use the **Key Admins** group instead of **KeyCredential Administrators** and skip the **Configure Permissions for Key Registration** step.
|
||||
|
||||
The **KeyCredential Administrators** global group provides the AD FS service with the permissions needed to perform key registration. The Windows Hello for Business group provides the AD FS service with the permissions needed to enroll a Windows Hello for Business authentication certificate on behalf of the provisioning user.
|
||||
|
||||
Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials.
|
||||
|
||||
@ -24,7 +24,7 @@ ms.reviewer:
|
||||
- Certificate trust
|
||||
|
||||
|
||||
The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The certificate trust model requires manually updating the current schema to the Windows Server 2016 schema. If you already have a Windows Server 2016 domain controller in your forest, you can skip the next step.
|
||||
The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The certificate trust model requires manually updating the current schema to the Windows Server 2016 schema. If you already have a Windows Server 2016 domain controller in your forest, you can skip the **Updating the Schema** and **Create the KeyCredential Admins Security Global Group** steps.
|
||||
|
||||
Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\<drive>:\support\adprep** on the Windows Server 2016 DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role.
|
||||
|
||||
|
||||
@ -97,14 +97,14 @@ The smart card reader device name is constructed in the form <*VendorName*>
|
||||
| 607 | Reader object failed to start monitor thread: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.<br>%1 = Windows error code |
|
||||
| 608 | Reader monitor failed to create power down timer: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.<br>%1 = Windows error code |
|
||||
| 609 | Reader monitor failed to create overlapped event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.<br>%1 = Windows error code |
|
||||
| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1 If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This is a benign error that does not affect end use of a smart card and can be ignored.<br>%1 = Windows error code<br>%2 = Name of the smart card reader<br>%3 = IOCTL that was sent<br>%4 = First 4 bytes of the command sent to the smart card |
|
||||
| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1 If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This can indicate hardware failure, but this error can also occur if a smart card or smart card reader is removed from the system while an operation is in progress.<br>%1 = Windows error code<br>%2 = Name of the smart card reader<br>%3 = IOCTL that was sent<br>%4 = First 4 bytes of the command sent to the smart card <br> These events are caused by legacy functionality in the smart card stack. It can be ignored if there is no noticeable failure in the smart card usage scenarios.|
|
||||
| 611 | Smart Card Reader initialization failed | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve this issue. |
|
||||
| 612 | Reader insertion monitor error retry threshold reached: %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.<br>%1 = Windows error code |
|
||||
| 615 | Reader removal monitor error retry threshold reached: %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.<br>%1 = Windows error code |
|
||||
| 616 | Reader monitor '%2' received uncaught error code: %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.<br>%1 = Windows error code<br>%2 = Reader name |
|
||||
| 617 | Reader monitor '%1' exception -- exiting thread | An unknown error occurred while monitoring a smart card reader for smart card insertions and removals. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.<br>%1 = Smart card reader name |
|
||||
| 618 | Smart Card Resource Manager encountered an unrecoverable internal error. | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. |
|
||||
| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. This error may also occur if the event is queried before the smart card service is ready. In this case the error is benign and can be ignored.<br>%1 = Windows error code |
|
||||
| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.<br>%1 = Windows error code <br>These events are caused by legacy functionality in the smart card stack. It can be ignored if there is no noticeable failure in the smart card usage scenarios. |
|
||||
| 622 | Server Control failed to access stop event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.<br>%1 = Windows error code |
|
||||
|
||||
## Smart card Plug and Play events
|
||||
|
||||
@ -37,7 +37,15 @@ If BitLocker is enabled on a drive before Group Policy has been applied to enfor
|
||||
|
||||
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
|
||||
The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the C: drive to AD DS, you would use the following command from an elevated command prompt: **manage-bde -protectors -adbackup C:**.
|
||||
The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt:
|
||||
|
||||
```PowerShell
|
||||
$BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive
|
||||
$RecoveryProtector = $BitLocker.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }
|
||||
|
||||
Backup-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID
|
||||
BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy).
|
||||
|
||||
@ -160,7 +160,7 @@ To add **Desktop apps**, complete the following fields, based on what results yo
|
||||
</tr>
|
||||
<tr>
|
||||
<td>All fields marked as “*”</td>
|
||||
<td>All files signed by any publisher. (Not recommended)</td>
|
||||
<td>All files signed by any publisher. (Not recommended and may not work)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Publisher only</td>
|
||||
|
||||
@ -1072,7 +1072,7 @@
|
||||
###### [Network security: Allow Local System to use computer identity for NTLM](security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md)
|
||||
###### [Network security: Allow LocalSystem NULL session fallback](security-policy-settings/network-security-allow-localsystem-null-session-fallback.md)
|
||||
###### [Network security: Allow PKU2U authentication requests to this computer to use online identities](security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md)
|
||||
###### [Network security: Configure encryption types allowed for Kerberos Win7 only](security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md)
|
||||
###### [Network security: Configure encryption types allowed for Kerberos](security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md)
|
||||
###### [Network security: Do not store LAN Manager hash value on next password change](security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md)
|
||||
###### [Network security: Force logoff when logon hours expire](security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md)
|
||||
###### [Network security: LAN Manager authentication level](security-policy-settings/network-security-lan-manager-authentication-level.md)
|
||||
|
||||
@ -44,13 +44,13 @@ The Automated investigation starts by analyzing the supported entities from the
|
||||
|
||||
### Details of an Automated investigation
|
||||
|
||||
As the investigation proceeds, you'll be able to view the details of the investigation. Selecting a triggering alert brings you to the investigation details view where you can pivot from the **Investigation graph**, **Alerts**, **Machines**, **Threats**, **Entities**, and **Log** tabs.
|
||||
As the investigation proceeds, you'll be able to view the details of the investigation. Selecting a triggering alert brings you to the investigation details view where you can pivot from the **Investigation graph**, **Alerts**, **Machines**, **Evidence**, **Entities**, and **Log** tabs.
|
||||
|
||||
In the **Alerts** tab, you'll see the alert that started the investigation.
|
||||
|
||||
The **Machines** tab shows where the alert was seen.
|
||||
|
||||
The **Threats** tab shows the entities that were found to be malicious during the investigation.
|
||||
The **Evidence** tab shows the entities that were found to be malicious during the investigation.
|
||||
|
||||
During an Automated investigation, details about each analyzed entity is categorized in the **Entities** tab. You'll be able to see the determination for each entity type, such as whether it was determined to be malicious, suspicious, or clean.
|
||||
|
||||
|
||||
@ -102,7 +102,7 @@ You'll also have access to the following sections that help you see details of t
|
||||
- Investigation graph
|
||||
- Alerts
|
||||
- Machines
|
||||
- Key findings
|
||||
- Evidence
|
||||
- Entities
|
||||
- Log
|
||||
- Pending actions
|
||||
@ -138,7 +138,7 @@ Selecting a machine using the checkbox brings up the machine details pane where
|
||||
|
||||
Clicking on an machine name brings you the machine page.
|
||||
|
||||
### Key findings
|
||||
### Evidence
|
||||
Shows details related to threats associated with this investigation.
|
||||
|
||||
### Entities
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Network security Configure encryption types allowed for Kerberos Win7 only (Windows 10)
|
||||
title: Network security Configure encryption types allowed for Kerberos
|
||||
description: Describes the best practices, location, values and security considerations for the Network security Configure encryption types allowed for Kerberos Win7 only security policy setting.
|
||||
ms.assetid: 303d32cc-415b-44ba-96c0-133934046ece
|
||||
ms.reviewer:
|
||||
|
||||
@ -51,7 +51,7 @@ As a cloud service, it is required that computers have access to the internet an
|
||||
|
||||
| **Service**| **Description** |**URL** |
|
||||
| :--: | :-- | :-- |
|
||||
| *Windows Defender Antivirus cloud-delivered protection service, also referred to as Microsoft Active Protection Service (MAPS)*|Used by Windows Defender Antivirus to provide cloud-delivered protection|\*.wdcp.microsoft.com \*.wdcpalt.microsoft.com \*.wd.microsoft.com|
|
||||
| *Windows Defender Antivirus cloud-delivered protection service, also referred to as Microsoft Active Protection Service (MAPS)*|Used by Windows Defender Antivirus to provide cloud-delivered protection|wdcp.microsoft.com wdcpalt.microsoft.com|
|
||||
| *Microsoft Update Service (MU)*| Security intelligence and product updates |\*.update.microsoft.com|
|
||||
| *Security intelligence updates Alternate Download Location (ADL)*| Alternate location for Windows Defender Antivirus Security intelligence updates if the installed Security intelligence is out of date (7 or more days behind)| \*.download.microsoft.com|
|
||||
| *Malware submission storage*|Upload location for files submitted to Microsoft via the Submission form or automatic sample submission | ussus1eastprod.blob.core.windows.net ussus1westprod.blob.core.windows.net usseu1northprod.blob.core.windows.net usseu1westprod.blob.core.windows.net ussuk1southprod.blob.core.windows.net ussuk1westprod.blob.core.windows.net ussas1eastprod.blob.core.windows.net ussas1southeastprod.blob.core.windows.net ussau1eastprod.blob.core.windows.net ussau1southeastprod.blob.core.windows.net |
|
||||
|
||||
@ -99,7 +99,7 @@ Users with administrator privileges or malware running as an administrator user
|
||||
|
||||
Since the ISG relies on identifying executables as being known good, there are cases where it may classify legitimate executables as unknown, leading to blocks that need to be resolved either with a rule in the WDAC policy, a catalog signed by a certificate trusted in the WDAC policy or by deployment through a WDAC managed installer. Typically, this is due to an installer or application using a dynamic file as part of execution. These files do not tend to build up known good reputation. Auto-updating applications have also been observed using this mechanism and may be flagged by the ISG.
|
||||
|
||||
Modern apps are not supported with the ISG heuristic and will need to be separately authorized in your WDAC policy. As modern apps are signed by the Microsoft Store and Microsoft Store for Business. it is straightforward to authorize modern apps with signer rules in the WDAC policy.
|
||||
Modern apps are not supported with the ISG heuristic and will need to be separately authorized in your WDAC policy. As modern apps are signed by the Microsoft Store and Microsoft Store for Business, it is straightforward to authorize modern apps with signer rules in the WDAC policy.
|
||||
|
||||
The ISG heuristic does not authorize kernel mode drivers. The WDAC policy must have rules that allow the necessary drivers to run.
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user