mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 06:17:22 +00:00
Merge branch 'master' into wdeg-events
This commit is contained in:
Justin Hall
commit
ef5d0aa087
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Details about how to add employees to the Enterprise Mode Site List Portal.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
|
||||
ms.sitesec: library
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c
|
||||
title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Add multiple sites to your Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2).
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd
|
||||
title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26
|
||||
title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that''s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 513e8f3b-fedf-4d57-8d81-1ea4fdf1ac0b
|
||||
title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: security
|
||||
description: Administrative templates and Internet Explorer 11
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3
|
||||
title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Details about how Approvers can approve open change requests in the Enterprise Mode Site List Portal.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
|
||||
ms.sitesec: library
|
||||
|
||||
@ -6,8 +6,8 @@ ms.prod: ie11
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
ms.author: lizross
|
||||
author: jdeckerms
|
||||
ms.author: dougkim
|
||||
ms.date: 08/14/2017
|
||||
ms.localizationpriority: low
|
||||
---
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
description: Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: a145e80f-eb62-4116-82c4-3cc35fd064b6
|
||||
title: Collect data using Enterprise Site Discovery
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Details about how the Administrator can use the Settings page to set up Groups and roles, the Enterprise Mode Site List Portal environment, and the freeze dates for production changes.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
title: Use the Settings page to finish setting up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
|
||||
ms.sitesec: library
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Details about how to create a change request within the Enterprise Mode Site List Portal.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
title: Create a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
|
||||
ms.sitesec: library
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
description: Delete a single site from your global Enterprise Mode site list.
|
||||
ms.pagetype: appcompat
|
||||
ms.mktglfcycl: deploy
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 41413459-b57f-48da-aedb-4cbec1e2981a
|
||||
title: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 76aa9a85-6190-4c3a-bc25-0f914de228ea
|
||||
title: Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Use the topics in this section to learn how to set up and use Enterprise Mode, Enterprise Mode Site List Manager, and the Enterprise Mode Site List Portal for your company.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: d52ba8ba-b3c7-4314-ba14-0610e1d8456e
|
||||
title: Enterprise Mode for Internet Explorer 11 (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 7 or Windows 8.1 Update.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 17c61547-82e3-48f2-908d-137a71938823
|
||||
title: Enterprise Mode schema v.1 guidance (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 10.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5
|
||||
title: Enterprise Mode schema v.2 guidance (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 9ee7c13d-6fca-4446-bc22-d23a0213a95d
|
||||
title: Export your Enterprise Mode site list from the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Instructions about how to clear all of the sites from your global Enterprise Mode site list.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 90f38a6c-e0e2-4c93-9a9e-c425eca99e97
|
||||
title: Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Instructions about how to remove sites from a local compatibility view list.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: f6ecaa75-ebcb-4f8d-8721-4cd6e73c0ac9
|
||||
title: Remove sites from a local compatibility view list (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Instructions about how to remove sites from a local Enterprise Mode site list.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: c7d6dd0b-e264-42bb-8c9d-ac2f837018d2
|
||||
title: Remove sites from a local Enterprise Mode site list (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 254a986b-494f-4316-92c1-b089ee8b3e0a
|
||||
title: Save your site list to XML in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Details about how Administrators can schedule approved change requests for production in the Enterprise Mode Site List Portal.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
title: Schedule approved change requests for production using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
|
||||
ms.sitesec: library
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Search to see if a specific site already appears in your global Enterprise Mode site list.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: e399aeaf-6c3b-4cad-93c9-813df6ad47f9
|
||||
title: Search your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Set up and turn on Enterprise Mode logging and data collection in your organization.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 2e98a280-f677-422f-ba2e-f670362afcde
|
||||
title: Set up Enterprise Mode logging and data collection (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Details about how to set up the Enterprise Mode Site List Portal for your organization.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
title: Set up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
|
||||
ms.sitesec: library
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: How to turn Enteprrise Mode off temporarily while testing websites and how to turn it off completely if you no longer want to to use it.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 5027c163-71e0-49b8-9dc0-f0a7310c7ae3
|
||||
title: Turn off Enterprise Mode (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Turn on local user control and logging for Enterprise Mode.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 6622ecce-24b1-497e-894a-e1fd5a8a66d1
|
||||
title: Turn on local control and logging for Enterprise Mode (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Manager.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: f4dbed4c-08ff-40b1-ab3f-60d3b6e8ec9b
|
||||
title: Use the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: security
|
||||
description: Use this section to learn about how to turn on and use IE7 Enterprise Mode or IE8 Enterprise Mode.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
ms.assetid: 238ead3d-8920-429a-ac23-02f089c4384a
|
||||
title: Using IE7 Enterprise Mode or IE8 Enterprise Mode (Internet Explorer 11 for IT Pros)
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Details about how to make sure your change request info is accurate within the pre-production environment of the Enterprise Mode Site List Portal.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
title: Verify your changes using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
|
||||
ms.sitesec: library
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Details about how the Requester makes sure that the change request update is accurate within the production environment using the Enterprise Mode Site List Portal.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
title: Verify the change request update in the production environment using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
|
||||
ms.sitesec: library
|
||||
|
||||
@ -3,7 +3,7 @@ ms.localizationpriority: low
|
||||
ms.mktglfcycl: deploy
|
||||
ms.pagetype: appcompat
|
||||
description: Details about how to view the active Enterprise Mode Site List from the Enterprise Mode Site List Portal.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.prod: ie11
|
||||
title: View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: What's new in App-V for Windows 10, version 1703 and earlier (Windows 10)
|
||||
description: Information about what's new in App-V for Windows 10, version 1703 and earlier.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10)
|
||||
description: How to automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer).
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10)
|
||||
description: How to automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer).
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Automatically clean up unpublished packages on the App-V client (Windows 10)
|
||||
description: How to automatically clean up any unpublished packages on your App-V client devices.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10)
|
||||
description: How to automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer) PowerShell cmdlet or the user interface.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Available Mobile Device Management (MDM) settings for App-V (Windows 10)
|
||||
description: A list of the available MDM settings for App-V on Windows 10.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Create and apply an App-V project template to a sequenced App-V package (Windows 10)
|
||||
description: Steps for how to create and apply an App-V project template (.appvt) to a sequenced App-V package.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Release Notes for App-V for Windows 10, version 1703 (Windows 10)
|
||||
description: A list of known issues and workarounds for App-V running on Windows 10, version 1703.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Release Notes for App-V for Windows 10, version 1607 (Windows 10)
|
||||
description: A list of known issues and workarounds for App-V running on Windows 10, version 1607.
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Manually sequence a new app using the Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10)
|
||||
description: How to manually sequence a new app using the App-V Sequencer
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.pagetype: mdop, appcompat, virtualization
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -4,9 +4,9 @@ description: How to set up Cortana to help your salespeople get proactive insigh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: How to send feedback to Microsoft about Cortana at work.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: How to connect Cortana to Office 365 so your employees are notified
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: The list of Group Policy and mobile device management (MDM) policy
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: How to integrate Cortana with Power BI to help your employees get a
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: A test scenario walking you through signing in and managing the not
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: A test scenario about how to perform a quick search with Cortana at
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: A test scenario about how to set a location-based reminder using Co
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: A test scenario about how to use Cortana at work to find your upcom
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: A test scenario about how to use Cortana at work to send email to a
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: A test scenario about how to use Cortana with the Suggested reminde
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: An optional test scenario about how to use Cortana at work with Win
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: A list of suggested testing scenarios that you can use to test Cort
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@ description: How to create voice commands that use Cortana to perform voice-enab
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizross
|
||||
ms.author: dougkim
|
||||
ms.date: 10/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -7,7 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: mobile
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 05/02/2018
|
||||
ms.topic: article
|
||||
|
||||
@ -187,7 +187,7 @@ On a desktop computer, navigate to **Settings** > **Accounts** > **Work ac
|
||||
## Guidance for accounts on shared PCs
|
||||
|
||||
* We recommend no local admin accounts on the PC to improve the reliability and security of the PC.
|
||||
* When a PC is set up in shared PC mode with the default deletion policy, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account managment happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Guest** and **Kiosk** will also be deleted automatically at sign out.
|
||||
* When a PC is set up in shared PC mode with the default deletion policy, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account managment happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Guest** and **Kiosk** will be deleted automatically at sign out.
|
||||
* On a Windows PC joined to Azure Active Directory:
|
||||
* By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC.
|
||||
* With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal.
|
||||
|
||||
@ -6,7 +6,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: plan
|
||||
ms.pagetype: appcompat
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
author: jdeckerms
|
||||
ms.date: 04/19/2017
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
@ -6,8 +6,12 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: aadake
|
||||
ms.date: 12/20/2018
|
||||
ms.topic: article
|
||||
ms.author: justinha
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 03/26/2019
|
||||
---
|
||||
|
||||
# Kernel DMA Protection for Thunderbolt™ 3
|
||||
@ -98,12 +102,12 @@ No, Kernel DMA Protection only protects against drive-by DMA attacks after the O
|
||||
DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping.
|
||||
Please check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external).
|
||||
|
||||
*For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the image below
|
||||
*For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the following image.
|
||||
|
||||
|
||||
|
||||
### What should I do if the drivers for my Thunderbolt™ 3 peripherals do not support DMA-remapping?
|
||||
If the peripherals do have class drivers provided by Windows 10, please use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, please contact your peripheral vendor/driver vendor to update the driver to support this functionality.
|
||||
If the peripherals do have class drivers provided by Windows 10, please use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, please contact your peripheral vendor/driver vendor to update the driver to support this functionality. Details for driver compatibility requirements can be found at the [Microsoft Partner Center](https://partner.microsoft.com/dashboard/collaborate/packages/4142).
|
||||
|
||||
### Do Microsoft drivers support DMA-remapping?
|
||||
In Windows 10 1803 and beyond, the Microsoft inbox drivers for USB XHCI (3.x) Controllers, Storage AHCI/SATA Controllers and Storage NVMe Controllers support DMA-remapping.
|
||||
|
||||
@ -387,8 +387,8 @@
|
||||
|
||||
#####Rules
|
||||
###### [Manage suppression rules](windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage automation allowed/blocked](windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage allowed/blocked](windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage automation allowed/blocked lists](windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage allowed/blocked lists](windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage automation file uploads](windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage automation folder exclusions](windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
@ -374,8 +374,8 @@
|
||||
|
||||
####Rules
|
||||
##### [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation allowed/blocked](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage allowed/blocked](manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage allowed/blocked lists](manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
@ -66,7 +66,7 @@ Add-MsolRoleMember -RoleName "Security Administrator" -RoleMemberEmailAddress "s
|
||||
Add-MsolRoleMember -RoleName "Security Reader" -RoleMemberEmailAddress "reader@Contoso.onmicrosoft.com"
|
||||
```
|
||||
|
||||
For more information see, [Manage Azure AD group and role membership](https://technet.microsoft.com/library/321d532e-407d-4e29-a00a-8afbe23008dd#BKMK_ManageGroups).
|
||||
For more information see, [Add or remove group memberships](https://technet.microsoft.com/library/321d532e-407d-4e29-a00a-8afbe23008dd#BKMK_ManageGroups).
|
||||
|
||||
## Assign user access using the Azure portal
|
||||
For more information, see [Assign administrator and non-administrator roles to uses with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal).
|
||||
|
||||
@ -48,7 +48,7 @@ ms.date: 04/24/2018
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a folder called *OptionalParamsPolicy* and the file *WindowsDefenderATPOnboardingScript.cmd*.
|
||||
|
||||
3. Open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**.
|
||||
3. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**.
|
||||
|
||||
4. In the **Group Policy Management Editor**, go to **Computer configuration**, then **Preferences**, and then **Control panel settings**.
|
||||
|
||||
@ -78,7 +78,7 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa
|
||||
|
||||
b. Copy _AtpConfiguration.adml_ into _C:\\Windows\\PolicyDefinitions\\en-US_
|
||||
|
||||
2. Open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the GPO you want to configure and click **Edit**.
|
||||
2. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11), right-click the GPO you want to configure and click **Edit**.
|
||||
|
||||
3. In the **Group Policy Management Editor**, go to **Computer configuration**.
|
||||
|
||||
@ -110,7 +110,7 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*.
|
||||
|
||||
3. Open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**.
|
||||
3. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**.
|
||||
|
||||
4. In the **Group Policy Management Editor**, go to **Computer configuration,** then **Preferences**, and then **Control panel settings**.
|
||||
|
||||
|
||||
@ -61,7 +61,7 @@ You can use existing System Center Configuration Manager functionality to create
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOnboardingScript.cmd*.
|
||||
|
||||
3. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682178.aspx) topic.
|
||||
3. Deploy the package by following the steps in the [Packages and Programs in Configuration Manager](https://docs.microsoft.com/en-us/sccm/apps/deploy-use/packages-and-programs) topic.
|
||||
|
||||
a. Choose a predefined device collection to deploy the package to.
|
||||
|
||||
@ -92,7 +92,7 @@ Possible values are:
|
||||
|
||||
The default value in case the registry key doesn’t exist is 1.
|
||||
|
||||
For more information about System Center Configuration Manager Compliance see [Compliance Settings in Configuration Manager](https://technet.microsoft.com/library/gg681958.aspx).
|
||||
For more information about System Center Configuration Manager Compliance see [Get started with compliance settings in System Center Configuration Manager](https://docs.microsoft.com/sccm/compliance/get-started/get-started-with-compliance-settings).
|
||||
|
||||
|
||||
|
||||
@ -115,7 +115,7 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*.
|
||||
|
||||
3. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682178.aspx) topic.
|
||||
3. Deploy the package by following the steps in the [Packages and Programs in Configuration Manager](https://docs.microsoft.com/en-us/sccm/apps/deploy-use/packages-and-programs) topic.
|
||||
|
||||
a. Choose a predefined device collection to deploy the package to.
|
||||
|
||||
@ -155,7 +155,7 @@ Path: “HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status”
|
||||
Name: “OnboardingState”
|
||||
Value: “1”
|
||||
```
|
||||
For more information about System Center Configuration Manager Compliance see [Compliance Settings in Configuration Manager](https://technet.microsoft.com/library/gg681958.aspx).
|
||||
For more information about System Center Configuration Manager Compliance see [Get started with compliance settings in System Center Configuration Manager](https://docs.microsoft.com/sccm/compliance/get-started/get-started-with-compliance-settings).
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -14,7 +14,6 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 12/14/2018
|
||||
---
|
||||
|
||||
# Onboard servers to the Windows Defender ATP service
|
||||
@ -45,7 +44,22 @@ For a practical guidance on what needs to be in place for licensing and infrastr
|
||||
|
||||
## Windows Server 2012 R2 and Windows Server 2016
|
||||
|
||||
To onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP, you’ll need to:
|
||||
There are two options to onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP:
|
||||
|
||||
- **Option 1**: Onboard through Azure Security Center
|
||||
- **Option 2**: Onboard through Windows Defender Security Center
|
||||
|
||||
### Option 1: Onboard servers through Azure Security Center
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
|
||||
2. Select Windows Server 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Onboard Servers in Azure Security Center**.
|
||||
|
||||
4. Follow the onboarding instructions in [Windows Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
|
||||
### Option 2: Onboard servers through Windows Defender Security Center
|
||||
You'll need to tak the following steps if you choose to onboard servers through Windows Defender Security Center.
|
||||
|
||||
- For Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients.
|
||||
|
||||
@ -53,7 +67,7 @@ To onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender AT
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
- Turn on server monitoring from Windows Defender Security Center.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Operations Management Suite (OMS), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through [Multi Homing support](https://blogs.technet.microsoft.com/msoms/2016/05/26/oms-log-analytics-agent-multi-homing-support/). Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Operations Management Suite (OMS), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through Multi Homing support. Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below.
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
@ -73,7 +87,7 @@ The following steps are required to enable this integration:
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
|
||||
2. Select Windows Server 2012R2 and 2016 as the operating system.
|
||||
2. Select Windows Server 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
|
||||
@ -201,7 +215,7 @@ To offboard the server, you can use either of the following methods:
|
||||
1. Get your Workspace ID:
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
b. Select **Windows Server 2012R2 and 2016** as the operating system and get your Workspace ID:
|
||||
b. Select **Windows Server 2012 R2 and 2016** as the operating system and get your Workspace ID:
|
||||
|
||||
|
||||
|
||||
|
||||
@ -44,6 +44,11 @@ A reinstalled or renamed machine will generate a new machine entity in Windows D
|
||||
**Machine was offboarded**</br>
|
||||
If the machine was offboarded it will still appear in machines list. After 7 days, the machine health state should change to inactive.
|
||||
|
||||
|
||||
**Machine is not sending signals**
|
||||
If the machine is not sending any signals for more than 7 days to any of the Windows Defender ATP channels for any reason including conditions that fall under misconfigured machines classification, a machine can be considered inactive.
|
||||
|
||||
|
||||
Do you expect a machine to be in ‘Active’ status? [Open a support ticket ticket](https://support.microsoft.com/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636206786382823561).
|
||||
|
||||
## Misconfigured machines
|
||||
|
||||
@ -55,6 +55,11 @@ On the top navigation you can:
|
||||
|
||||
5. Review the details in the Summary tab, then click **Save**.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Blocking IPs, domains, or URLs is currently available on limited preview only. This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforeced. While the option is not yet generally available, it will only be used when identified during an investigation.
|
||||
|
||||
|
||||
## Manage indicators
|
||||
1. In the navigation pane, select **Settings** > **Allowed/blocked list**.
|
||||
|
||||
|
||||
@ -15,14 +15,11 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 06/14/2018
|
||||
---
|
||||
|
||||
# Manage automation allowed/blocked lists
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
@ -70,4 +67,5 @@ You can define the conditions for when entities are identified as malicious or s
|
||||
|
||||
## Related topics
|
||||
- [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage allowed/blocked lists](manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Minimum requirements for Windows Defender ATP
|
||||
description: Minimum network and data storage configuration, machine hardware and software requirements, and deployment channel requirements for Windows Defender ATP.
|
||||
keywords: minimum requirements, Windows Defender Advanced Threat Protection minimum requirements, network and data storage, machine configuration, deployment channel
|
||||
description: Understand the licensing requirements and requirements for onboarding machines to the sercvie
|
||||
keywords: minimum requirements, licensing, comparison table
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -15,7 +15,6 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 11/20/2018
|
||||
---
|
||||
|
||||
# Minimum requirements for Windows Defender ATP
|
||||
|
||||
@ -44,7 +44,7 @@ When you open the portal, you’ll see the main areas of the application:
|
||||
- (3) Search, Community center, Time settings, Help and support, Feedback
|
||||
|
||||
> [!NOTE]
|
||||
> Malware related detections will only appear if your machines are using [Windows Defender Antivirus](https://technet.microsoft.com/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
|
||||
> Malware related detections will only appear if your machines are using Windows Defender Antivirus as the default real-time protection antimalware product.
|
||||
|
||||
You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section.
|
||||
|
||||
|
||||
@ -1,313 +1,312 @@
|
||||
---
|
||||
title: Troubleshoot Windows Defender ATP onboarding issues
|
||||
description: Troubleshoot issues that might arise during the onboarding of machines or to the Windows Defender ATP service.
|
||||
keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds, sensor data and diagnostics
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 09/07/2018
|
||||
---
|
||||
|
||||
# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
|
||||
You might need to troubleshoot the Windows Defender ATP onboarding process if you encounter issues.
|
||||
This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the machines.
|
||||
|
||||
If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, it might indicate an onboarding or connectivity problem.
|
||||
|
||||
## Troubleshoot onboarding when deploying with Group Policy
|
||||
Deployment with Group Policy is done by running the onboarding script on the machines. The Group Policy console does not indicate if the deployment has succeeded or not.
|
||||
|
||||
If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, you can check the output of the script on the machines. For more information, see [Troubleshoot onboarding when deploying with a script](#troubleshoot-onboarding-when-deploying-with-a-script).
|
||||
|
||||
If the script completes successfully, see [Troubleshoot onboarding issues](#troubleshoot-onboarding-issues) for additional errors that might occur.
|
||||
|
||||
## Troubleshoot onboarding issues when deploying with System Center Configuration Manager
|
||||
When onboarding machines using the following versions of System Center Configuration Manager:
|
||||
- System Center 2012 Configuration Manager
|
||||
- System Center 2012 R2 Configuration Manager
|
||||
- System Center Configuration Manager (current branch) version 1511
|
||||
- System Center Configuration Manager (current branch) version 1602
|
||||
|
||||
|
||||
Deployment with the above-mentioned versions of System Center Configuration Manager is done by running the onboarding script on the machines. You can track the deployment in the Configuration Manager Console.
|
||||
|
||||
If the deployment fails, you can check the output of the script on the machines.
|
||||
|
||||
If the onboarding completed successfully but the machines are not showing up in the **Machines list** after an hour, see [Troubleshoot onboarding issues](#troubleshoot-onboarding-issues) for additional errors that might occur.
|
||||
|
||||
## Troubleshoot onboarding when deploying with a script
|
||||
|
||||
**Check the result of the script on the machine**:
|
||||
1. Click **Start**, type **Event Viewer**, and press **Enter**.
|
||||
|
||||
2. Go to **Windows Logs** > **Application**.
|
||||
|
||||
3. Look for an event from **WDATPOnboarding** event source.
|
||||
|
||||
If the script fails and the event is an error, you can check the event ID in the following table to help you troubleshoot the issue.
|
||||
> [!NOTE]
|
||||
> The following event IDs are specific to the onboarding script only.
|
||||
|
||||
Event ID | Error Type | Resolution steps
|
||||
:---|:---|:---
|
||||
5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.
|
||||
10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically<br> ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```.<br>Verify that the script was ran as an administrator.
|
||||
15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). <br> <br> If the machine is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again.
|
||||
15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
|
||||
30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location<br>```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```.<br>The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
65 | Insufficient privileges| Run the script again with administrator privileges.
|
||||
|
||||
## Troubleshoot onboarding issues using Microsoft Intune
|
||||
You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue.
|
||||
|
||||
If you have configured policies in Intune and they are not propagated on machines, you might need to configure automatic MDM enrollment.
|
||||
|
||||
Use the following tables to understand the possible causes of issues while onboarding:
|
||||
|
||||
- Microsoft Intune error codes and OMA-URIs table
|
||||
- Known issues with non-compliance table
|
||||
- Mobile Device Management (MDM) event logs table
|
||||
|
||||
If none of the event logs and troubleshooting steps work, download the Local script from the **Machine management** section of the portal, and run it in an elevated command prompt.
|
||||
|
||||
**Microsoft Intune error codes and OMA-URIs**:
|
||||
|
||||
|
||||
Error Code Hex | Error Code Dec | Error Description | OMA-URI | Possible cause and troubleshooting steps
|
||||
:---|:---|:---|:---|:---
|
||||
0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding <br> Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields. <br><br> **Troubleshooting steps:** <br> Check the event IDs in the [View agent onboarding errors in the machine event log](#view-agent-onboarding-errors-in-the-endpoint-event-log) section. <br><br> Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx).
|
||||
| | | | Onboarding <br> Offboarding <br> SampleSharing | **Possible cause:** Windows Defender ATP Policy registry key does not exist or the OMA DM client doesn't have permissions to write to it. <br><br> **Troubleshooting steps:** Ensure that the following registry key exists: ```HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection``` <br> <br> If it doesn't exist, open an elevated command and add the key.
|
||||
| | | | SenseIsRunning <br> OnboardingState <br> OrgId | **Possible cause:** An attempt to remediate by read-only property. Onboarding has failed. <br><br> **Troubleshooting steps:** Check the troubleshooting steps in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](#troubleshoot-windows-defender-advanced-threat-protection-onboarding-issues). <br><br> Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx).
|
||||
|| | | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU. <br><br> Currently is supported platforms: Enterprise, Education, and Professional. <br> Server is not supported.
|
||||
0x87D101A9 | -2016345687 |Syncml(425): The requested command failed because the sender does not have adequate access control permissions (ACL) on the recipient. | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU. <br><br> Currently is supported platforms: Enterprise, Education, and Professional.
|
||||
|
||||
<br>
|
||||
**Known issues with non-compliance**
|
||||
|
||||
The following table provides information on issues with non-compliance and how you can address the issues.
|
||||
|
||||
Case | Symptoms | Possible cause and troubleshooting steps
|
||||
:---|:---|:---
|
||||
1 | Machine is compliant by SenseIsRunning OMA-URI. But is non-compliant by OrgId, Onboarding and OnboardingState OMA-URIs. | **Possible cause:** Check that user passed OOBE after Windows installation or upgrade. During OOBE onboarding couldn't be completed but SENSE is running already. <br><br> **Troubleshooting steps:** Wait for OOBE to complete.
|
||||
2 | Machine is compliant by OrgId, Onboarding, and OnboardingState OMA-URIs, but is non-compliant by SenseIsRunning OMA-URI. | **Possible cause:** Sense service's startup type is set as "Delayed Start". Sometimes this causes the Microsoft Intune server to report the machine as non-compliant by SenseIsRunning when DM session occurs on system start. <br><br> **Troubleshooting steps:** The issue should automatically be fixed within 24 hours.
|
||||
3 | Machine is non-compliant | **Troubleshooting steps:** Ensure that Onboarding and Offboarding policies are not deployed on the same machine at same time.
|
||||
|
||||
<br>
|
||||
**Mobile Device Management (MDM) event logs**
|
||||
|
||||
View the MDM event logs to troubleshoot issues that might arise during onboarding:
|
||||
|
||||
Log name: Microsoft\Windows\DeviceManagement-EnterpriseDiagnostics-Provider
|
||||
|
||||
Channel name: Admin
|
||||
|
||||
ID | Severity | Event description | Troubleshooting steps
|
||||
:---|:---|:---|:---
|
||||
1819 | Error | Windows Defender Advanced Threat Protection CSP: Failed to Set Node's Value. NodeId: (%1), TokenName: (%2), Result: (%3). | Download the [Cumulative Update for Windows 10, 1607](https://go.microsoft.com/fwlink/?linkid=829760).
|
||||
|
||||
## Troubleshoot onboarding issues on the machine
|
||||
If the deployment tools used does not indicate an error in the onboarding process, but machines are still not appearing in the machines list in an hour, go through the following verification topics to check if an error occurred with the Windows Defender ATP agent:
|
||||
- [View agent onboarding errors in the machine event log](#view-agent-onboarding-errors-in-the-endpoint-event-log)
|
||||
- [Ensure the diagnostic data service is enabled](#ensure-the-diagnostics-service-is-enabled)
|
||||
- [Ensure the service is set to start](#ensure-the-service-is-set-to-start)
|
||||
- [Ensure the machine has an Internet connection](#ensure-the-endpoint-has-an-internet-connection)
|
||||
- [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)
|
||||
|
||||
|
||||
### View agent onboarding errors in the machine event log
|
||||
|
||||
1. Click **Start**, type **Event Viewer**, and press **Enter**.
|
||||
|
||||
2. In the **Event Viewer (Local)** pane, expand **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE**.
|
||||
|
||||
> [!NOTE]
|
||||
> SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP.
|
||||
|
||||
3. Select **Operational** to load the log.
|
||||
|
||||
4. In the **Action** pane, click **Filter Current log**.
|
||||
|
||||
5. On the **Filter** tab, under **Event level:** select **Critical**, **Warning**, and **Error**, and click **OK**.
|
||||
|
||||
|
||||
|
||||
6. Events which can indicate issues will appear in the **Operational** pane. You can attempt to troubleshoot them based on the solutions in the following table:
|
||||
|
||||
Event ID | Message | Resolution steps
|
||||
:---|:---|:---
|
||||
5 | Windows Defender Advanced Threat Protection service failed to connect to the server at _variable_ | [Ensure the machine has Internet access](#ensure-the-endpoint-has-an-internet-connection).
|
||||
6 | Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. Failure code: _variable_ | [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md).
|
||||
7 | Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Ensure the machine has Internet access](#ensure-the-endpoint-has-an-internet-connection), then run the entire onboarding process again.
|
||||
9 | Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: variable | If the event happened during onboarding, reboot and re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). <br><br>If the event happened during offboarding, contact support.
|
||||
10 | Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: variable | If the event happened during onboarding, re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). <br><br>If the problem persists, contact support.
|
||||
15 | Windows Defender Advanced Threat Protection cannot start command channel with URL: _variable_ | [Ensure the machine has Internet access](#ensure-the-endpoint-has-an-internet-connection).
|
||||
17 | Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: variable | [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). If the problem persists, contact support.
|
||||
25 | Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: _variable_ | Contact support.
|
||||
27 | Failed to enable Windows Defender Advanced Threat Protection mode in Windows Defender. Onboarding process failed. Failure code: variable | Contact support.
|
||||
29 | Failed to read the offboarding parameters. Error type: %1, Error code: %2, Description: %3 | Ensure the machine has Internet access, then run the entire offboarding process again.
|
||||
30 | Failed to disable $(build.sense.productDisplayName) mode in Windows Defender Advanced Threat Protection. Failure code: %1 | Contact support.
|
||||
32 | $(build.sense.productDisplayName) service failed to request to stop itself after offboarding process. Failure code: %1 | Verify that the service start type is manual and reboot the machine.
|
||||
55 | Failed to create the Secure ETW autologger. Failure code: %1 | Reboot the machine.
|
||||
63 | Updating the start type of external service. Name: %1, actual start type: %2, expected start type: %3, exit code: %4 | Identify what is causing changes in start type of mentioned service. If the exit code is not 0, fix the start type manually to expected start type.
|
||||
64 | Starting stopped external service. Name: %1, exit code: %2 | Contact support if the event keeps re-appearing.
|
||||
68 | The start type of the service is unexpected. Service name: %1, actual start type: %2, expected start type: %3 | Identify what is causing changes in start type. Fix mentioned service start type.
|
||||
69 | The service is stopped. Service name: %1 | Start the mentioned service. Contact support if persists.
|
||||
|
||||
<br>
|
||||
There are additional components on the machine that the Windows Defender ATP agent depends on to function properly. If there are no onboarding related errors in the Windows Defender ATP agent event log, proceed with the following steps to ensure that the additional components are configured correctly.
|
||||
|
||||
<span id="ensure-the-diagnostics-service-is-enabled" />
|
||||
### Ensure the diagnostic data service is enabled
|
||||
If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the machine. The service might have been disabled by other programs or user configuration changes.
|
||||
|
||||
First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't).
|
||||
|
||||
### Ensure the service is set to start
|
||||
|
||||
**Use the command line to check the Windows 10 diagnostic data service startup type**:
|
||||
|
||||
1. Open an elevated command-line prompt on the machine:
|
||||
|
||||
a. Click **Start**, type **cmd**, and press **Enter**.
|
||||
|
||||
b. Right-click **Command prompt** and select **Run as administrator**.
|
||||
|
||||
2. Enter the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc qc diagtrack
|
||||
```
|
||||
|
||||
If the service is enabled, then the result should look like the following screenshot:
|
||||
|
||||
|
||||
|
||||
If the `START_TYPE` is not set to `AUTO_START`, then you'll need to set the service to automatically start.
|
||||
|
||||
|
||||
**Use the command line to set the Windows 10 diagnostic data service to automatically start:**
|
||||
|
||||
1. Open an elevated command-line prompt on the machine:
|
||||
|
||||
a. Click **Start**, type **cmd**, and press **Enter**.
|
||||
|
||||
b. Right-click **Command prompt** and select **Run as administrator**.
|
||||
|
||||
2. Enter the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc config diagtrack start=auto
|
||||
```
|
||||
|
||||
3. A success message is displayed. Verify the change by entering the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc qc diagtrack
|
||||
```
|
||||
|
||||
4. Start the service.
|
||||
|
||||
a. In the command prompt, type the following command and press **Enter**:
|
||||
|
||||
```text
|
||||
sc start diagtrack
|
||||
```
|
||||
|
||||
### Ensure the machine has an Internet connection
|
||||
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
|
||||
WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment.
|
||||
|
||||
To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls) topic.
|
||||
|
||||
If the verification fails and your environment is using a proxy to connect to the Internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic.
|
||||
|
||||
### Ensure that Windows Defender Antivirus is not disabled by a policy
|
||||
**Problem**: The Windows Defender ATP service does not start after onboarding.
|
||||
|
||||
**Symptom**: Onboarding successfully completes, but you see error 577 when trying to start the service.
|
||||
|
||||
**Solution**: If your machines are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. You must ensure that it's not disabled in system policy.
|
||||
|
||||
- Depending on the tool that you use to implement policies, you'll need to verify that the following Windows Defender policies are cleared:
|
||||
|
||||
- DisableAntiSpyware
|
||||
- DisableAntiVirus
|
||||
|
||||
For example, in Group Policy there should be no entries such as the following values:
|
||||
|
||||
- ```<Key Path="SOFTWARE\Policies\Microsoft\Windows Defender"><KeyValue Value="0" ValueKind="DWord" Name="DisableAntiSpyware"/></Key>```
|
||||
- ```<Key Path="SOFTWARE\Policies\Microsoft\Windows Defender"><KeyValue Value="0" ValueKind="DWord" Name="DisableAntiVirus"/></Key>```
|
||||
- After clearing the policy, run the onboarding steps again.
|
||||
|
||||
- You can also check the following registry key values to verify that the policy is disabled:
|
||||
|
||||
1. Open the registry ```key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender```.
|
||||
2. Ensure that the value ```DisableAntiSpyware``` is not present.
|
||||
|
||||
|
||||
|
||||
|
||||
## Troubleshoot onboarding issues on a server
|
||||
If you encounter issues while onboarding a server, go through the following verification steps to address possible issues.
|
||||
|
||||
- [Ensure Microsoft Monitoring Agent (MMA) is installed and configured to report sensor data to the service](configure-server-endpoints-windows-defender-advanced-threat-protection.md#server-mma)
|
||||
- [Ensure that the server proxy and Internet connectivity settings are configured properly](configure-server-endpoints-windows-defender-advanced-threat-protection.md#server-proxy)
|
||||
|
||||
You might also need to check the following:
|
||||
- Check that there is a Windows Defender Advanced Threat Protection Service running in the **Processes** tab in **Task Manager**. For example:
|
||||
|
||||
|
||||
|
||||
- Check **Event Viewer** > **Applications and Services Logs** > **Operation Manager** to see if there are any errors.
|
||||
|
||||
- In **Services**, check if the **Microsoft Monitoring Agent** is running on the server. For example,
|
||||
|
||||
|
||||
|
||||
- In **Microsoft Monitoring Agent** > **Azure Log Analytics (OMS)**, check the Workspaces and verify that the status is running.
|
||||
|
||||
|
||||
|
||||
- Check to see that machines are reflected in the **Machines list** in the portal.
|
||||
|
||||
|
||||
## Licensing requirements
|
||||
Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers:
|
||||
|
||||
- Windows 10 Enterprise E5
|
||||
- Windows 10 Education E5
|
||||
- Microsoft 365 Enterprise E5 which includes Windows 10 Enterprise E5
|
||||
|
||||
For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx#tab=2).
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootonboarding-belowfoldlink)
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure machine proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
---
|
||||
title: Troubleshoot Windows Defender ATP onboarding issues
|
||||
description: Troubleshoot issues that might arise during the onboarding of machines or to the Windows Defender ATP service.
|
||||
keywords: troubleshoot onboarding, onboarding issues, event viewer, data collection and preview builds, sensor data and diagnostics
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: troubleshooting
|
||||
---
|
||||
|
||||
# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
|
||||
You might need to troubleshoot the Windows Defender ATP onboarding process if you encounter issues.
|
||||
This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the machines.
|
||||
|
||||
If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, it might indicate an onboarding or connectivity problem.
|
||||
|
||||
## Troubleshoot onboarding when deploying with Group Policy
|
||||
Deployment with Group Policy is done by running the onboarding script on the machines. The Group Policy console does not indicate if the deployment has succeeded or not.
|
||||
|
||||
If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, you can check the output of the script on the machines. For more information, see [Troubleshoot onboarding when deploying with a script](#troubleshoot-onboarding-when-deploying-with-a-script).
|
||||
|
||||
If the script completes successfully, see [Troubleshoot onboarding issues on the machines](#troubleshoot-onboarding-issues-on-the-machine) for additional errors that might occur.
|
||||
|
||||
## Troubleshoot onboarding issues when deploying with System Center Configuration Manager
|
||||
When onboarding machines using the following versions of System Center Configuration Manager:
|
||||
- System Center 2012 Configuration Manager
|
||||
- System Center 2012 R2 Configuration Manager
|
||||
- System Center Configuration Manager (current branch) version 1511
|
||||
- System Center Configuration Manager (current branch) version 1602
|
||||
|
||||
|
||||
Deployment with the above-mentioned versions of System Center Configuration Manager is done by running the onboarding script on the machines. You can track the deployment in the Configuration Manager Console.
|
||||
|
||||
If the deployment fails, you can check the output of the script on the machines.
|
||||
|
||||
If the onboarding completed successfully but the machines are not showing up in the **Machines list** after an hour, see [Troubleshoot onboarding issues on the machine](#troubleshoot-onboarding-issues-on-the-machine) for additional errors that might occur.
|
||||
|
||||
## Troubleshoot onboarding when deploying with a script
|
||||
|
||||
**Check the result of the script on the machine**:
|
||||
1. Click **Start**, type **Event Viewer**, and press **Enter**.
|
||||
|
||||
2. Go to **Windows Logs** > **Application**.
|
||||
|
||||
3. Look for an event from **WDATPOnboarding** event source.
|
||||
|
||||
If the script fails and the event is an error, you can check the event ID in the following table to help you troubleshoot the issue.
|
||||
> [!NOTE]
|
||||
> The following event IDs are specific to the onboarding script only.
|
||||
|
||||
Event ID | Error Type | Resolution steps
|
||||
:---|:---|:---
|
||||
5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.
|
||||
10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically<br> ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```.<br>Verify that the script was ran as an administrator.
|
||||
15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). <br> <br> If the machine is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again.
|
||||
15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
|
||||
30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location<br>```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```.<br>The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
|
||||
65 | Insufficient privileges| Run the script again with administrator privileges.
|
||||
|
||||
## Troubleshoot onboarding issues using Microsoft Intune
|
||||
You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue.
|
||||
|
||||
If you have configured policies in Intune and they are not propagated on machines, you might need to configure automatic MDM enrollment.
|
||||
|
||||
Use the following tables to understand the possible causes of issues while onboarding:
|
||||
|
||||
- Microsoft Intune error codes and OMA-URIs table
|
||||
- Known issues with non-compliance table
|
||||
- Mobile Device Management (MDM) event logs table
|
||||
|
||||
If none of the event logs and troubleshooting steps work, download the Local script from the **Machine management** section of the portal, and run it in an elevated command prompt.
|
||||
|
||||
**Microsoft Intune error codes and OMA-URIs**:
|
||||
|
||||
|
||||
Error Code Hex | Error Code Dec | Error Description | OMA-URI | Possible cause and troubleshooting steps
|
||||
:---|:---|:---|:---|:---
|
||||
0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding <br> Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields. <br><br> **Troubleshooting steps:** <br> Check the event IDs in the [View agent onboarding errors in the machine event log](#view-agent-onboarding-errors-in-the-machine-event-log) section. <br><br> Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx).
|
||||
| | | | Onboarding <br> Offboarding <br> SampleSharing | **Possible cause:** Windows Defender ATP Policy registry key does not exist or the OMA DM client doesn't have permissions to write to it. <br><br> **Troubleshooting steps:** Ensure that the following registry key exists: ```HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection``` <br> <br> If it doesn't exist, open an elevated command and add the key.
|
||||
| | | | SenseIsRunning <br> OnboardingState <br> OrgId | **Possible cause:** An attempt to remediate by read-only property. Onboarding has failed. <br><br> **Troubleshooting steps:** Check the troubleshooting steps in [Troubleshoot onboarding issues on the machine](#troubleshoot-onboarding-issues-on-the-machine). <br><br> Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx).
|
||||
|| | | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU. <br><br> Currently is supported platforms: Enterprise, Education, and Professional. <br> Server is not supported.
|
||||
0x87D101A9 | -2016345687 |Syncml(425): The requested command failed because the sender does not have adequate access control permissions (ACL) on the recipient. | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU. <br><br> Currently is supported platforms: Enterprise, Education, and Professional.
|
||||
|
||||
<br>
|
||||
**Known issues with non-compliance**
|
||||
|
||||
The following table provides information on issues with non-compliance and how you can address the issues.
|
||||
|
||||
Case | Symptoms | Possible cause and troubleshooting steps
|
||||
:---|:---|:---
|
||||
1 | Machine is compliant by SenseIsRunning OMA-URI. But is non-compliant by OrgId, Onboarding and OnboardingState OMA-URIs. | **Possible cause:** Check that user passed OOBE after Windows installation or upgrade. During OOBE onboarding couldn't be completed but SENSE is running already. <br><br> **Troubleshooting steps:** Wait for OOBE to complete.
|
||||
2 | Machine is compliant by OrgId, Onboarding, and OnboardingState OMA-URIs, but is non-compliant by SenseIsRunning OMA-URI. | **Possible cause:** Sense service's startup type is set as "Delayed Start". Sometimes this causes the Microsoft Intune server to report the machine as non-compliant by SenseIsRunning when DM session occurs on system start. <br><br> **Troubleshooting steps:** The issue should automatically be fixed within 24 hours.
|
||||
3 | Machine is non-compliant | **Troubleshooting steps:** Ensure that Onboarding and Offboarding policies are not deployed on the same machine at same time.
|
||||
|
||||
<br>
|
||||
**Mobile Device Management (MDM) event logs**
|
||||
|
||||
View the MDM event logs to troubleshoot issues that might arise during onboarding:
|
||||
|
||||
Log name: Microsoft\Windows\DeviceManagement-EnterpriseDiagnostics-Provider
|
||||
|
||||
Channel name: Admin
|
||||
|
||||
ID | Severity | Event description | Troubleshooting steps
|
||||
:---|:---|:---|:---
|
||||
1819 | Error | Windows Defender Advanced Threat Protection CSP: Failed to Set Node's Value. NodeId: (%1), TokenName: (%2), Result: (%3). | Download the [Cumulative Update for Windows 10, 1607](https://go.microsoft.com/fwlink/?linkid=829760).
|
||||
|
||||
## Troubleshoot onboarding issues on the machine
|
||||
If the deployment tools used does not indicate an error in the onboarding process, but machines are still not appearing in the machines list in an hour, go through the following verification topics to check if an error occurred with the Windows Defender ATP agent:
|
||||
- [View agent onboarding errors in the machine event log](#view-agent-onboarding-errors-in-the-machine-event-log)
|
||||
- [Ensure the diagnostic data service is enabled](#ensure-the-diagnostics-service-is-enabled)
|
||||
- [Ensure the service is set to start](#ensure-the-service-is-set-to-start)
|
||||
- [Ensure the machine has an Internet connection](#ensure-the-machine-has-an-internet-connection)
|
||||
- [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)
|
||||
|
||||
|
||||
### View agent onboarding errors in the machine event log
|
||||
|
||||
1. Click **Start**, type **Event Viewer**, and press **Enter**.
|
||||
|
||||
2. In the **Event Viewer (Local)** pane, expand **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE**.
|
||||
|
||||
> [!NOTE]
|
||||
> SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP.
|
||||
|
||||
3. Select **Operational** to load the log.
|
||||
|
||||
4. In the **Action** pane, click **Filter Current log**.
|
||||
|
||||
5. On the **Filter** tab, under **Event level:** select **Critical**, **Warning**, and **Error**, and click **OK**.
|
||||
|
||||
|
||||
|
||||
6. Events which can indicate issues will appear in the **Operational** pane. You can attempt to troubleshoot them based on the solutions in the following table:
|
||||
|
||||
Event ID | Message | Resolution steps
|
||||
:---|:---|:---
|
||||
5 | Windows Defender Advanced Threat Protection service failed to connect to the server at _variable_ | [Ensure the machine has Internet access](#ensure-the-machine-has-an-internet-connection).
|
||||
6 | Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. Failure code: _variable_ | [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md).
|
||||
7 | Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Ensure the machine has Internet access](#ensure-the-machine-has-an-internet-connection), then run the entire onboarding process again.
|
||||
9 | Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: variable | If the event happened during onboarding, reboot and re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). <br><br>If the event happened during offboarding, contact support.
|
||||
10 | Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: variable | If the event happened during onboarding, re-attempt running the onboarding script. For more information, see [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). <br><br>If the problem persists, contact support.
|
||||
15 | Windows Defender Advanced Threat Protection cannot start command channel with URL: _variable_ | [Ensure the machine has Internet access](#ensure-the-machine-has-an-internet-connection).
|
||||
17 | Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: variable | [Run the onboarding script again](configure-endpoints-script-windows-defender-advanced-threat-protection.md). If the problem persists, contact support.
|
||||
25 | Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: _variable_ | Contact support.
|
||||
27 | Failed to enable Windows Defender Advanced Threat Protection mode in Windows Defender. Onboarding process failed. Failure code: variable | Contact support.
|
||||
29 | Failed to read the offboarding parameters. Error type: %1, Error code: %2, Description: %3 | Ensure the machine has Internet access, then run the entire offboarding process again.
|
||||
30 | Failed to disable $(build.sense.productDisplayName) mode in Windows Defender Advanced Threat Protection. Failure code: %1 | Contact support.
|
||||
32 | $(build.sense.productDisplayName) service failed to request to stop itself after offboarding process. Failure code: %1 | Verify that the service start type is manual and reboot the machine.
|
||||
55 | Failed to create the Secure ETW autologger. Failure code: %1 | Reboot the machine.
|
||||
63 | Updating the start type of external service. Name: %1, actual start type: %2, expected start type: %3, exit code: %4 | Identify what is causing changes in start type of mentioned service. If the exit code is not 0, fix the start type manually to expected start type.
|
||||
64 | Starting stopped external service. Name: %1, exit code: %2 | Contact support if the event keeps re-appearing.
|
||||
68 | The start type of the service is unexpected. Service name: %1, actual start type: %2, expected start type: %3 | Identify what is causing changes in start type. Fix mentioned service start type.
|
||||
69 | The service is stopped. Service name: %1 | Start the mentioned service. Contact support if persists.
|
||||
|
||||
<br>
|
||||
There are additional components on the machine that the Windows Defender ATP agent depends on to function properly. If there are no onboarding related errors in the Windows Defender ATP agent event log, proceed with the following steps to ensure that the additional components are configured correctly.
|
||||
|
||||
<span id="ensure-the-diagnostics-service-is-enabled" />
|
||||
### Ensure the diagnostic data service is enabled
|
||||
If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the machine. The service might have been disabled by other programs or user configuration changes.
|
||||
|
||||
First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't).
|
||||
|
||||
### Ensure the service is set to start
|
||||
|
||||
**Use the command line to check the Windows 10 diagnostic data service startup type**:
|
||||
|
||||
1. Open an elevated command-line prompt on the machine:
|
||||
|
||||
a. Click **Start**, type **cmd**, and press **Enter**.
|
||||
|
||||
b. Right-click **Command prompt** and select **Run as administrator**.
|
||||
|
||||
2. Enter the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc qc diagtrack
|
||||
```
|
||||
|
||||
If the service is enabled, then the result should look like the following screenshot:
|
||||
|
||||
|
||||
|
||||
If the `START_TYPE` is not set to `AUTO_START`, then you'll need to set the service to automatically start.
|
||||
|
||||
|
||||
**Use the command line to set the Windows 10 diagnostic data service to automatically start:**
|
||||
|
||||
1. Open an elevated command-line prompt on the machine:
|
||||
|
||||
a. Click **Start**, type **cmd**, and press **Enter**.
|
||||
|
||||
b. Right-click **Command prompt** and select **Run as administrator**.
|
||||
|
||||
2. Enter the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc config diagtrack start=auto
|
||||
```
|
||||
|
||||
3. A success message is displayed. Verify the change by entering the following command, and press **Enter**:
|
||||
|
||||
```text
|
||||
sc qc diagtrack
|
||||
```
|
||||
|
||||
4. Start the service.
|
||||
|
||||
a. In the command prompt, type the following command and press **Enter**:
|
||||
|
||||
```text
|
||||
sc start diagtrack
|
||||
```
|
||||
|
||||
### Ensure the machine has an Internet connection
|
||||
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
|
||||
WinHTTP is independent of the Internet browsing proxy settings and other user context applications and must be able to detect the proxy servers that are available in your particular environment.
|
||||
|
||||
To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls) topic.
|
||||
|
||||
If the verification fails and your environment is using a proxy to connect to the Internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic.
|
||||
|
||||
### Ensure that Windows Defender Antivirus is not disabled by a policy
|
||||
**Problem**: The Windows Defender ATP service does not start after onboarding.
|
||||
|
||||
**Symptom**: Onboarding successfully completes, but you see error 577 when trying to start the service.
|
||||
|
||||
**Solution**: If your machines are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. You must ensure that it's not disabled in system policy.
|
||||
|
||||
- Depending on the tool that you use to implement policies, you'll need to verify that the following Windows Defender policies are cleared:
|
||||
|
||||
- DisableAntiSpyware
|
||||
- DisableAntiVirus
|
||||
|
||||
For example, in Group Policy there should be no entries such as the following values:
|
||||
|
||||
- ```<Key Path="SOFTWARE\Policies\Microsoft\Windows Defender"><KeyValue Value="0" ValueKind="DWord" Name="DisableAntiSpyware"/></Key>```
|
||||
- ```<Key Path="SOFTWARE\Policies\Microsoft\Windows Defender"><KeyValue Value="0" ValueKind="DWord" Name="DisableAntiVirus"/></Key>```
|
||||
- After clearing the policy, run the onboarding steps again.
|
||||
|
||||
- You can also check the following registry key values to verify that the policy is disabled:
|
||||
|
||||
1. Open the registry ```key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender```.
|
||||
2. Ensure that the value ```DisableAntiSpyware``` is not present.
|
||||
|
||||
|
||||
|
||||
|
||||
## Troubleshoot onboarding issues on a server
|
||||
If you encounter issues while onboarding a server, go through the following verification steps to address possible issues.
|
||||
|
||||
- [Ensure Microsoft Monitoring Agent (MMA) is installed and configured to report sensor data to the service](configure-server-endpoints-windows-defender-advanced-threat-protection.md#server-mma)
|
||||
- [Ensure that the server proxy and Internet connectivity settings are configured properly](configure-server-endpoints-windows-defender-advanced-threat-protection.md#server-proxy)
|
||||
|
||||
You might also need to check the following:
|
||||
- Check that there is a Windows Defender Advanced Threat Protection Service running in the **Processes** tab in **Task Manager**. For example:
|
||||
|
||||
|
||||
|
||||
- Check **Event Viewer** > **Applications and Services Logs** > **Operation Manager** to see if there are any errors.
|
||||
|
||||
- In **Services**, check if the **Microsoft Monitoring Agent** is running on the server. For example,
|
||||
|
||||
|
||||
|
||||
- In **Microsoft Monitoring Agent** > **Azure Log Analytics (OMS)**, check the Workspaces and verify that the status is running.
|
||||
|
||||
|
||||
|
||||
- Check to see that machines are reflected in the **Machines list** in the portal.
|
||||
|
||||
|
||||
## Licensing requirements
|
||||
Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers:
|
||||
|
||||
- Windows 10 Enterprise E5
|
||||
- Windows 10 Education E5
|
||||
- Microsoft 365 Enterprise E5 which includes Windows 10 Enterprise E5
|
||||
|
||||
For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx#tab=2).
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootonboarding-belowfoldlink)
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure machine proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user