mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-18 16:27:22 +00:00
Merge branch 'traya1-delete-folder' into v-benzyd-4867565
This commit is contained in:
Benzy Dharmanayagam
GitHub
commit
f19b6823e7
@ -11,7 +11,7 @@
|
||||
}
|
||||
:scores {
|
||||
;;:terminology 100
|
||||
:qualityscore 65 ;; Confirmed with Hugo that you just comment out the single score and leave the structure in place
|
||||
:qualityscore 80 ;; Confirmed with Hugo that you just comment out the single score and leave the structure in place
|
||||
;;:spelling 40
|
||||
}
|
||||
}
|
||||
|
||||
@ -16530,6 +16530,11 @@
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/deployment/update/waas-mobile-updates.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr",
|
||||
|
||||
@ -11,7 +11,7 @@ ms.prod: edge
|
||||
ms.sitesec: library
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 01/17/2020
|
||||
ms.date: 02/16/2021
|
||||
---
|
||||
|
||||
# Deploy Microsoft Edge Legacy kiosk mode
|
||||
@ -22,7 +22,7 @@ ms.date: 01/17/2020
|
||||
> Professional, Enterprise, and Education
|
||||
|
||||
> [!NOTE]
|
||||
> You've reached the documentation for Microsoft Edge Legacy (version 45 and earlier.) To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). For information about kiosk mode in the new version of Microsoft Edge, see [Microsoft Edge kiosk mode](https://docs.microsoft.com/DeployEdge/microsoft-edge-kiosk-mode).
|
||||
> You've reached the documentation for Microsoft Edge Legacy (version 45 and earlier.) To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). For information about kiosk mode in the new version of Microsoft Edge, see [Microsoft Edge kiosk mode](https://docs.microsoft.com/DeployEdge/microsoft-edge-configure-kiosk-mode).
|
||||
|
||||
In the Windows 10 October 2018 Update, we added the capability to use Microsoft Edge Legacy as a kiosk using assigned access. With assigned access, you create a tailored browsing experience locking down a Windows 10 device to only run as a single-app or multi-app kiosk. Assigned access restricts a local standard user account so that it only has access to one or more Windows app, such as Microsoft Edge Legacy in kiosk mode.
|
||||
|
||||
|
||||
@ -410,6 +410,46 @@ Valid values are:
|
||||
- 1 – Enable.
|
||||
- 0 (default) – Disable.
|
||||
|
||||
<a href="" id="configuration-disablecputhrottleonidlescans"></a>**Configuration/DisableCpuThrottleOnIdleScans**<br>
|
||||
Indicates whether the CPU will be throttled for scheduled scans while the device is idle. This feature is enabled by default and will not throttle the CPU for scheduled scans performed when the device is otherwise idle, regardless of what ScanAvgCPULoadFactor is set to. For all other scheduled scans this flag will have no impact and normal throttling will occur.
|
||||
|
||||
The data type is integer.
|
||||
|
||||
Supported operations are Add, Delete, Get, Replace.
|
||||
|
||||
Valid values are:
|
||||
- 1 – Enable.
|
||||
- 0 (default) – Disable.
|
||||
|
||||
<a href="" id="configuration-meteredconnectionupdates"></a>**Configuration/MeteredConnectionUpdates**<br>
|
||||
Allow managed devices to update through metered connections. Data charges may apply.
|
||||
|
||||
The data type is integer.
|
||||
|
||||
Supported operations are Add, Delete, Get, Replace.
|
||||
|
||||
Valid values are:
|
||||
- 1 – Enable.
|
||||
- 0 (default) – Disable.
|
||||
|
||||
<a href="" id="configuration-allownetworkprotectiononwinserver"></a>**Configuration/AllowNetworkProtectionOnWinServer**<br>
|
||||
This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server. If false, the value of EnableNetworkProtection will be ignored.
|
||||
|
||||
The data type is integer.
|
||||
|
||||
Supported operations are Add, Delete, Get, Replace.
|
||||
|
||||
Valid values are:
|
||||
- 1 – Enable.
|
||||
- 0 (default) – Disable.
|
||||
|
||||
<a href="" id="configuration-exclusionipaddress"></a>**Configuration/ExclusionIpAddress**<br>
|
||||
Allows an administrator to explicitly disable network packet inspection made by wdnisdrv on a particular set of IP addresses.
|
||||
|
||||
The data type is string.
|
||||
|
||||
Supported operations are Add, Delete, Get, Replace.
|
||||
|
||||
<a href="" id="configuration-enablefilehashcomputation"></a>**Configuration/EnableFileHashComputation**
|
||||
Enables or disables file hash computation feature.
|
||||
When this feature is enabled Windows defender will compute hashes for files it scans.
|
||||
|
||||
File diff suppressed because one or more lines are too long
@ -1392,12 +1392,12 @@ ms.date: 10/08/2020
|
||||
- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth)
|
||||
- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth)
|
||||
- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders)
|
||||
- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids)
|
||||
- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses)
|
||||
- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork)
|
||||
- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings)
|
||||
- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids)
|
||||
- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses)
|
||||
- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallationallowinstallationofmatchingdeviceids)
|
||||
- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallationallowinstallationofmatchingdevicesetupclasses)
|
||||
- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallationpreventdevicemetadatafromnetwork)
|
||||
- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofdevicesnotdescribedbyotherpolicysettings)
|
||||
- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofmatchingdeviceids)
|
||||
- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofmatchingdevicesetupclasses)
|
||||
- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera)
|
||||
- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow)
|
||||
- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings)
|
||||
|
||||
@ -220,12 +220,12 @@ ms.date: 07/18/2019
|
||||
- [DeviceGuard/EnableVirtualizationBasedSecurity](./policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity)
|
||||
- [DeviceGuard/LsaCfgFlags](./policy-csp-deviceguard.md#deviceguard-lsacfgflags)
|
||||
- [DeviceGuard/RequirePlatformSecurityFeatures](./policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures)
|
||||
- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids)
|
||||
- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses)
|
||||
- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork)
|
||||
- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings)
|
||||
- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids)
|
||||
- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses)
|
||||
- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallationallowinstallationofmatchingdeviceids)
|
||||
- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallationallowinstallationofmatchingdevicesetupclasses)
|
||||
- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallationpreventdevicemetadatafromnetwork)
|
||||
- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofdevicesnotdescribedbyotherpolicysettings)
|
||||
- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofmatchingdeviceids)
|
||||
- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofmatchingdevicesetupclasses)
|
||||
- [DeviceLock/MinimumPasswordAge](./policy-csp-devicelock.md#devicelock-minimumpasswordage)
|
||||
- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera)
|
||||
- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow)
|
||||
@ -731,7 +731,6 @@ ms.date: 07/18/2019
|
||||
- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells)
|
||||
- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout)
|
||||
- [Search/AllowCloudSearch](./policy-csp-search.md#search-allowcloudsearch)
|
||||
- [Search/AllowCortanaInAAD](./policy-csp-search.md#search-allowcortanainaad)
|
||||
- [Search/AllowFindMyFiles](./policy-csp-search.md#search-allowfindmyfiles)
|
||||
- [Search/AllowIndexingEncryptedStoresOrItems](./policy-csp-search.md#search-allowindexingencryptedstoresoritems)
|
||||
- [Search/AllowSearchToUseLocation](./policy-csp-search.md#search-allowsearchtouselocation)
|
||||
|
||||
@ -5655,28 +5655,28 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids" id="deviceinstallation-allowinstallationofmatchingdeviceids">DeviceInstallation/AllowInstallationOfMatchingDeviceIDs</a>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallationallowinstallationofmatchingdeviceids" id="deviceinstallation-allowinstallationofmatchingdeviceids">DeviceInstallation/AllowInstallationOfMatchingDeviceIDs</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses" id="deviceinstallation-allowinstallationofmatchingdevicesetupclasses">DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses</a>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallationallowinstallationofmatchingdevicesetupclasses" id="deviceinstallation-allowinstallationofmatchingdevicesetupclasses">DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceinstanceids"id="deviceinstallation-allowinstallationofmatchingdeviceinstanceids">DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs</a>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallationallowinstallationofmatchingdeviceinstanceids"id="deviceinstallation-allowinstallationofmatchingdeviceinstanceids">DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork" id="deviceinstallation-preventdevicemetadatafromnetwork">DeviceInstallation/PreventDeviceMetadataFromNetwork</a>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallationpreventdevicemetadatafromnetwork" id="deviceinstallation-preventdevicemetadatafromnetwork">DeviceInstallation/PreventDeviceMetadataFromNetwork</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings" id="deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings">DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings</a>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofdevicesnotdescribedbyotherpolicysettings" id="deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings">DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids" id="deviceinstallation-preventinstallationofmatchingdeviceids">DeviceInstallation/PreventInstallationOfMatchingDeviceIDs</a>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofmatchingdeviceids" id="deviceinstallation-preventinstallationofmatchingdeviceids">DeviceInstallation/PreventInstallationOfMatchingDeviceIDs</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceinstanceids"id="deviceinstallation-preventinstallationofmatchingdeviceinstanceids">DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs</a>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofmatchingdeviceinstanceids"id="deviceinstallation-preventinstallationofmatchingdeviceinstanceids">DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses" id="deviceinstallation-preventinstallationofmatchingdevicesetupclasses">DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses</a>
|
||||
<a href="./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofmatchingdevicesetupclasses" id="deviceinstallation-preventinstallationofmatchingdevicesetupclasses">DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
@ -7571,9 +7571,6 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
<dd>
|
||||
<a href="./policy-csp-search.md#search-allowcloudsearch" id="search-allowcloudsearch">Search/AllowCloudSearch</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-search.md#search-allowcortanainaad" id="search-allowcortanainaad">Search/AllowCortanaInAAD</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-search.md#search-allowfindmyfiles" id="search-allowfindmyfiles">Search/AllowFindMyFiles</a>
|
||||
</dd>
|
||||
|
||||
@ -22,28 +22,28 @@ ms.localizationpriority: medium
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#deviceinstallation-allowinstallationofmatchingdeviceids">DeviceInstallation/AllowInstallationOfMatchingDeviceIDs</a>
|
||||
<a href="#deviceinstallationallowinstallationofmatchingdeviceids">DeviceInstallation/AllowInstallationOfMatchingDeviceIDs</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#deviceinstallation-allowinstallationofmatchingdeviceinstanceids">DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs</a>
|
||||
<a href="#deviceinstallationallowinstallationofmatchingdeviceinstanceids">DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#deviceinstallation-allowinstallationofmatchingdevicesetupclasses">DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses</a>
|
||||
<a href="#deviceinstallationallowinstallationofmatchingdevicesetupclasses">DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#deviceinstallation-preventdevicemetadatafromnetwork">DeviceInstallation/PreventDeviceMetadataFromNetwork</a>
|
||||
<a href="#deviceinstallationpreventdevicemetadatafromnetwork">DeviceInstallation/PreventDeviceMetadataFromNetwork</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings">DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings</a>
|
||||
<a href="#deviceinstallationpreventinstallationofdevicesnotdescribedbyotherpolicysettings">DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#deviceinstallation-preventinstallationofmatchingdeviceids">DeviceInstallation/PreventInstallationOfMatchingDeviceIDs</a>
|
||||
<a href="#deviceinstallationpreventinstallationofmatchingdeviceids">DeviceInstallation/PreventInstallationOfMatchingDeviceIDs</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#deviceinstallation-preventinstallationofmatchingdeviceinstanceids">DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs</a>
|
||||
<a href="#deviceinstallationpreventinstallationofmatchingdeviceinstanceids">DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#deviceinstallation-preventinstallationofmatchingdevicesetupclasses">DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses</a>
|
||||
<a href="#deviceinstallationpreventinstallationofmatchingdevicesetupclasses">DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
@ -51,7 +51,7 @@ ms.localizationpriority: medium
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="deviceinstallation-allowinstallationofmatchingdeviceids"></a>**DeviceInstallation/AllowInstallationOfMatchingDeviceIDs**
|
||||
## DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
@ -165,7 +165,7 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="deviceinstallation-allowinstallationofmatchingdeviceinstanceids"></a>**DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs**
|
||||
## DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
@ -272,7 +272,7 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="deviceinstallation-allowinstallationofmatchingdevicesetupclasses"></a>**DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses**
|
||||
## DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
@ -395,7 +395,7 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="deviceinstallation-preventdevicemetadatafromnetwork"></a>**DeviceInstallation/PreventDeviceMetadataFromNetwork**
|
||||
## DeviceInstallation/PreventDeviceMetadataFromNetwork
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
@ -474,7 +474,7 @@ ADMX Info:
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings"></a>**DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings**
|
||||
## DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
@ -586,7 +586,7 @@ You can also block installation by using a custom profile in Intune.
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="deviceinstallation-preventinstallationofmatchingdeviceids"></a>**DeviceInstallation/PreventInstallationOfMatchingDeviceIDs**
|
||||
## DeviceInstallation/PreventInstallationOfMatchingDeviceIDs
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
@ -703,7 +703,7 @@ For example, this custom profile blocks installation and usage of USB devices wi
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="deviceinstallation-preventinstallationofmatchingdeviceinstanceids"></a>**DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs**
|
||||
## DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
@ -830,7 +830,7 @@ with
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="deviceinstallation-preventinstallationofmatchingdevicesetupclasses"></a>**DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses**
|
||||
## DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
|
||||
@ -82,7 +82,7 @@ Available in Windows 10, version 20H2. This policy setting allows IT admins to a
|
||||
>
|
||||
> Starting from Windows 10, version 20H2, it is recommended to use the LocalUsersandGroups policy instead of the RestrictedGroups policy. Applying both the policies to the same device is unsupported and may yield unpredictable results.
|
||||
|
||||
Here's an example of the policy definition XML for group configuration:
|
||||
Here is an example of the policy definition XML for group configuration:
|
||||
|
||||
```xml
|
||||
<GroupConfiguration>
|
||||
@ -104,7 +104,9 @@ where:
|
||||
- `<remove member>`: Specifies the SID or name of the member to remove from the specified group.
|
||||
|
||||
> [!NOTE]
|
||||
> When specifying member names of domain accounts, use fully qualified account names where possible (for example, domain_name\user_name) instead of isolated names (for example, group_name). This way, you can avoid getting ambiguous results when users or groups with the same name exist in multiple domains and locally. See [LookupAccountNameA function](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea#remarks) for more information.
|
||||
> When specifying member names of the user accounts, you must use following format – AzureAD/userUPN. For example, "AzureAD/user1@contoso.com" or "AzureAD/user2@contoso.co.uk".
|
||||
For adding Azure AD groups, you need to specify the Azure AD Group SID. Azure AD group names are not supported with this policy.
|
||||
for more information, see [LookupAccountNameA function](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea).
|
||||
|
||||
See [Use custom settings for Windows 10 devices in Intune](https://docs.microsoft.com/mem/intune/configuration/custom-settings-windows-10) for information on how to create custom profiles.
|
||||
|
||||
@ -121,35 +123,51 @@ See [Use custom settings for Windows 10 devices in Intune](https://docs.microsof
|
||||
|
||||
**Examples**
|
||||
|
||||
Example 1: Update action for adding and removing group members.
|
||||
Example 1: AAD focused.
|
||||
|
||||
The following example shows how you can update a local group (**Backup Operators**)—add a domain group as a member using its name (**Contoso\ITAdmins**), add the built-in Administrators group using its [well known SID](https://docs.microsoft.com/windows/win32/secauthz/well-known-sids), add a AAD group by its SID (**S-1-12-1-111111111-22222222222-3333333333-4444444444**), and remove a local account (**Guest**).
|
||||
The following example updates the built-in administrators group with AAD account "bob@contoso.com" and an Azure AD group with the SID **S-1-12-1-111111111-22222222222-3333333333-4444444444. On an AAD joined machines**.
|
||||
|
||||
```xml
|
||||
<GroupConfiguration>
|
||||
<accessgroup desc = "Administrators">
|
||||
<group action = "U" />
|
||||
<add member = "AzureAD\bob@contoso.com"/>
|
||||
<add member = "S-1-12-1-111111111-22222222222-3333333333-4444444444"/>
|
||||
</accessgroup>
|
||||
</GroupConfiguration>
|
||||
```
|
||||
|
||||
Example 2: Replace / Restrict the built-in administrators group with an AAD user account.
|
||||
|
||||
> [!NOTE]
|
||||
> When using ‘R’ replace option to configure the built-in ‘Administrators’ group, it is required to always specify the administrator as a member + any other custom members. This is because the built-in administrator must always be a member of the administrators group.
|
||||
|
||||
Example:
|
||||
```xml
|
||||
<GroupConfiguration>
|
||||
<accessgroup desc = "Administrators">
|
||||
<group action = "R" />
|
||||
<add member = "AzureAD\bob@contoso.com"/>
|
||||
<add member = "Administrator"/>
|
||||
</accessgroup>
|
||||
</GroupConfiguration>
|
||||
```
|
||||
Example 3: Update action for adding and removing group members on a hybrid joined machine.
|
||||
|
||||
The following example shows how you can update a local group (**Administrators**)—add an AD domain group as a member using its name (**Contoso\ITAdmins**), add a AAD group by its SID (**S-1-12-1-111111111-22222222222-3333333333-4444444444**), and remove a local account (**Guest**) if it exists.
|
||||
|
||||
```xml
|
||||
<GroupConfiguration>
|
||||
<accessgroup desc = "Backup Operators">
|
||||
<accessgroup desc = "Administrators">
|
||||
<group action = "U" />
|
||||
<add member = "Contoso\ITAdmins"/>
|
||||
<add member = "S-1-5-32-544"/>
|
||||
<add member = "S-1-12-1-111111111-22222222222-3333333333-4444444444"/>
|
||||
<remove member = "Guest"/>
|
||||
</accessgroup>
|
||||
</GroupConfiguration>
|
||||
```
|
||||
|
||||
Example 2: Restrict action for replacing the group membership.
|
||||
|
||||
The following example shows how you can restrict a local group (**Backup Operators**)—replace its membership with the built-in Administrators group using its [well known SID](https://docs.microsoft.com/windows/win32/secauthz/well-known-sids) and add a local account (**Guest**).
|
||||
|
||||
```xml
|
||||
<GroupConfiguration>
|
||||
<accessgroup desc = "Backup Operators">
|
||||
<group action = "R" />
|
||||
<add member = "S-1-5-32-544"/>
|
||||
<add member = "Guest"/>
|
||||
</accessgroup>
|
||||
</GroupConfiguration>
|
||||
```
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
@ -157,6 +175,17 @@ The following example shows how you can restrict a local group (**Backup Operato
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
> [!NOTE]
|
||||
>
|
||||
> When AAD group SID’s are added to local groups, during AAD account logon privileges are evaluated only for the following well-known groups on a Windows 10 device:
|
||||
>
|
||||
> - Administrators
|
||||
> - Users
|
||||
> - Guests
|
||||
> - Power Users
|
||||
> - Remote Desktop Users
|
||||
> - Remote Management Users
|
||||
|
||||
## FAQs
|
||||
|
||||
This section provides answers to some common questions you might have about the LocalUsersAndGroups policy CSP.
|
||||
@ -223,10 +252,69 @@ To troubleshoot Name/SID lookup APIs:
|
||||
```cmd
|
||||
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name LspDbgInfoLevel -Value 0x0 -Type dword -Force
|
||||
```
|
||||
|
||||
```xml
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" version="1.0">
|
||||
<xs:simpleType name="name">
|
||||
<xs:restriction base="xs:string">
|
||||
<xs:maxLength value="255" />
|
||||
</xs:restriction>
|
||||
</xs:simpleType>
|
||||
<xs:element name="accessgroup">
|
||||
<xs:complexType>
|
||||
<xs:sequence>
|
||||
<xs:element name="group" minOccurs="1" maxOccurs="1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Group Configuration Action</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:complexType>
|
||||
<xs:attribute name="action" type="name" use="required"/>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
<xs:element name="add" minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Group Member to Add</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:complexType>
|
||||
<xs:attribute name="member" type="name" use="required"/>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
<xs:element name="remove" minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Group Member to Remove</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:complexType>
|
||||
<xs:attribute name="member" type="name" use="required"/>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
<xs:element name="property" minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Group property to configure</xs:documentation>
|
||||
</xs:annotation>
|
||||
<xs:complexType>
|
||||
<xs:attribute name="desc" type="name" use="required"/>
|
||||
<xs:attribute name="value" type="name" use="required"/>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:sequence>
|
||||
<xs:attribute name="desc" type="name" use="required"/>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
<xs:element name="GroupConfiguration">
|
||||
<xs:complexType>
|
||||
<xs:sequence>
|
||||
<xs:element name="accessgroup" minOccurs="0" maxOccurs="unbounded">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Local Group Configuration</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:element>
|
||||
</xs:sequence>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
```
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 9 - Available in Windows 10, version 20H2.
|
||||
Available in Windows 10, version 20H2
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
@ -7,7 +7,7 @@ ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/27/2019
|
||||
ms.date: 02/12/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -25,9 +25,6 @@ manager: dansimp
|
||||
<dd>
|
||||
<a href="#search-allowcloudsearch">Search/AllowCloudSearch</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#search-allowcortanainaad">Search/AllowCortanaInAAD</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#search-allowfindmyfiles">Search/AllowFindMyFiles</a>
|
||||
</dd>
|
||||
@ -137,7 +134,6 @@ The following list shows the supported values:
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="search-allowcortanainaad"></a>**Search/AllowCortanaInAAD**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
@ -178,30 +174,6 @@ The following list shows the supported values:
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. If this policy is left in its default state, Cortana will not be shown in the AAD OOBE flow. If you opt-in to this policy, then the Cortana consent page will appear in the AAD OOBE flow..
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP English name: *Allow Cortana Page in OOBE on an AAD account*
|
||||
- GP name: *AllowCortanaInAAD*
|
||||
- GP path: *Windows Components/Search*
|
||||
- GP ADMX file name: *Search.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) - Not allowed. The Cortana consent page will not appear in AAD OOBE during setup.
|
||||
- 1 - Allowed. The Cortana consent page will appear in Azure AAD OOBE during setup.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="search-allowfindmyfiles"></a>**Search/AllowFindMyFiles**
|
||||
|
||||
|
||||
@ -182,6 +182,11 @@ If the Start layout is applied by Group Policy or MDM, and the policy is removed
|
||||
|
||||
4. Save the file and apply using any of the deployment methods.
|
||||
|
||||
> [!NOTE]
|
||||
> Office 2019 tiles might be removed from the Start menu when you upgrade Office 2019. This only occurs if Office 2019 app tiles are in a custom group in the Start menu and only contains the Office 2019 app tiles. To avoid this problem, place another app tile in the Office 2019 group prior to the upgrade. For example, add Notepad.exe or calc.exe to the group. This issue occurs because Office 2019 removes and reinstalls the apps when they are upgraded. Start removes empty groups when it detects that all apps for that group have been removed.
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
|
||||
@ -37,7 +37,7 @@
|
||||
"audience": "ITPro",
|
||||
"ms.topic": "article",
|
||||
"feedback_system": "None",
|
||||
"hideEdit": true,
|
||||
"hideEdit": false,
|
||||
"_op_documentIdPathDepotMapping": {
|
||||
"./": {
|
||||
"depot_name": "MSDN.win-configuration",
|
||||
|
||||
@ -24,6 +24,7 @@ This topic describes how to deploy Windows 10 Enterprise E3 or E5 licenses with
|
||||
>* Windows 10 Enterprise Subscription Activation (EA or MPSA) requires Windows 10 Pro, version 1703 or later.
|
||||
>* Windows 10 Enterprise E3 in CSP requires Windows 10 Pro, version 1607 or later.
|
||||
>* Automatic, non-KMS activation requires Windows 10, version 1803 or later, on a device with a firmware-embedded activation key.
|
||||
>* Windows 10 Enterprise Subscription Activation requires Windows 10 Enterprise per user licensing; it does not work on per device based licensing.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>An issue has been identified where devices can lose activation status or be blocked from upgrading to Windows Enterprise if the device is not able to connect to Windows Update. A workaround is to ensure that devices do not have the REG_DWORD present HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotConnectToWindowsUpdateInternetLocations and set to 1. If this REG_DWORD is present, it must be set to 0.
|
||||
|
||||
@ -77,7 +77,7 @@ ForEach($entry in $oulist){
|
||||
}
|
||||
```
|
||||
|
||||
Next, copy the following list of OU names and paths into a text file and save it as <b>C:\Setup\Scripts\oulist.txt</b>
|
||||
Next, copy the following list of OU names and paths into a text file and save it as **C:\Setup\Scripts\oulist.txt**
|
||||
|
||||
```text
|
||||
OUName,OUPath
|
||||
|
||||
@ -147,7 +147,7 @@ On **MDT01**:
|
||||
9. On the **Destination** page, in the **Specify the name of the directory that should be created** text box, type **Install - Adobe Reader** and click **Next**.
|
||||
10. On the **Command Details** page, in the **Command Line** text box, type **msiexec /i AcroRead.msi /q**, click **Next** twice, and then click **Finish**.
|
||||
|
||||
|
||||
|
||||
|
||||
The Adobe Reader application added to the Deployment Workbench.
|
||||
|
||||
@ -267,7 +267,7 @@ On **MDT01**:
|
||||
|
||||
For the ThinkStation P500 model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo ThinkStation P500 model has the 30A6003TUS model name, meaning the Machine Type is 30A6.
|
||||
|
||||
|
||||
|
||||
|
||||
To get the updates, download the drivers from the Lenovo ThinkVantage Update Retriever using its export function. You can also download the drivers by searching PC Support on the [Lenovo website](https://go.microsoft.com/fwlink/p/?LinkId=619543).
|
||||
|
||||
@ -361,6 +361,9 @@ In this section, you will learn how to configure the MDT Build Lab deployment sh
|
||||
|
||||
### Configure the rules
|
||||
|
||||
> [!NOTE]
|
||||
> The following instructions assume the device is online. If you're offline you can remove SLShare variable.
|
||||
|
||||
On **MDT01**:
|
||||
|
||||
1. Right-click the **MDT Production** deployment share and select **Properties**.
|
||||
@ -533,7 +536,7 @@ On **MDT01**:
|
||||
1. Download MDOP 2015 and copy the DaRT 10 installer file to the D:\\Setup\\DaRT 10 folder on MDT01 (DaRT\\DaRT 10\\Installers\\\<lang\>\\x64\\MSDaRT100.msi).
|
||||
2. Install DaRT 10 (MSDaRT10.msi) using the default settings.
|
||||
|
||||
|
||||
|
||||
|
||||
2. Copy the two tools CAB files from **C:\\Program Files\\Microsoft DaRT\\v10** (**Toolsx86.cab** and **Toolsx64.cab**) to the production deployment share at **D:\\MDTProduction\\Tools\\x86** and **D:\\MDTProduction\\Tools\\x64**, respectively.
|
||||
3. In the Deployment Workbench, right-click the **MDT Production** deployment share and select **Properties**.
|
||||
@ -604,13 +607,13 @@ On **HV01**:
|
||||
2. Installs the added application.
|
||||
3. Updates the operating system via your local Windows Server Update Services (WSUS) server.
|
||||
|
||||
|
||||
|
||||
|
||||
### Application installation
|
||||
|
||||
Following OS installation, Microsoft Office 365 Pro Plus - x64 is installed automatically.
|
||||
|
||||
|
||||
|
||||
|
||||
### Use the MDT monitoring feature
|
||||
|
||||
@ -731,7 +734,7 @@ On **MDT01**:
|
||||
The ISO that you got when updating the offline media item can be burned to a DVD and used directly (it will be bootable), but it is often more efficient to use USB sticks instead since they are faster and can hold more data. (A dual-layer DVD is limited to 8.5 GB.)
|
||||
|
||||
>[!TIP]
|
||||
>In this example, the .wim file is 5.5 GB in size. However, bootable USB sticks are formatted with the FAT32 file system which limits file size to 4.0 GB. This means you must split the .wim file, which can be done using DISM: <br> <br>Dism /Split-Image /ImageFile:D:\MDTOfflinemedia\Content\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.wim /SWMFile:E:\sources\install.swm /FileSize:3800. <br> <br>Windows Setup automatically installs from this file, provided you name it install.swm. The file names for the next files include numbers, for example: install2.swm, install3.swm. <br> <br>To enable split image in MDT, the Settings.xml file in your deployment share (ex: D:\MDTProduction\Control\Settings.xml) must have the **SkipWimSplit** value set to **False**. By default this value is set to True (\<SkipWimSplit\>True\</SkipWimSplit\>), so this must be changed and the offline media content updated.
|
||||
>In this example, the .wim file is 5.5 GB in size. However, bootable USB sticks are formatted with the FAT32 file system which limits file size to 4.0 GB. You can place the image on a different drive (ex: E:\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.swm) and then modify E:\Deploy\Control\OperatingSystems.xml to point to it. Alternatively to keep using the USB you must split the .wim file, which can be done using DISM: <br> <br>Dism /Split-Image /ImageFile:D:\MDTOfflinemedia\Content\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.wim /SWMFile:E:\sources\install.swm /FileSize:3800. <br> <br>Windows Setup automatically installs from this file, provided you name it install.swm. The file names for the next files include numbers, for example: install2.swm, install3.swm. <br> <br>To enable split image in MDT, the Settings.xml file in your deployment share (ex: D:\MDTProduction\Control\Settings.xml) must have the **SkipWimSplit** value set to **False**. By default this value is set to True (\<SkipWimSplit\>True\</SkipWimSplit\>), so this must be changed and the offline media content updated.
|
||||
|
||||
Follow these steps to create a bootable USB stick from the offline media content:
|
||||
|
||||
|
||||
@ -53,7 +53,7 @@ Several client computers are referenced in this guide with hostnames of PC0001 t
|
||||
|
||||
### Storage requirements
|
||||
|
||||
MDT01 and HV01 should have the ability to store up to 200 GB of files on a data drive (D:). If you use a computer with a single system partition (C:) you will need to adjust come procedures in this guide to specify the C: drive instead of the D: drive.
|
||||
MDT01 and HV01 should have the ability to store up to 200 GB of files on a data drive (D:). If you use a computer with a single system partition (C:), you will need to adjust some procedures in this guide to specify the C: drive instead of the D: drive.
|
||||
|
||||
### Hyper-V requirements
|
||||
|
||||
@ -256,7 +256,7 @@ When you have completed all the steps in this section to prepare for deployment,
|
||||
|
||||
**Sample files**
|
||||
|
||||
The following sample files are also available to help automate some MDT deployment tasks. This guide does not use these files, but they are made available here so that you can see how some tasks can be automated with Windows PowerShell.
|
||||
The following sample files are also available to help automate some MDT deployment tasks. This guide does not use these files, but they are made available here so you can see how some tasks can be automated with Windows PowerShell.
|
||||
- [Gather.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619361). This sample Windows PowerShell script performs the MDT Gather process in a simulated MDT environment. This allows you to test the MDT gather process and check to see if it is working correctly without performing a full Windows deployment.
|
||||
- [Set-OUPermissions.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619362). This sample Windows PowerShell script creates a domain account and then configures OU permissions to allow the account to join machines to the domain in the specified OU.
|
||||
- [MDTSample.zip](https://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT.
|
||||
- [MDTSample.zip](https://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT.
|
||||
|
||||
@ -28,19 +28,19 @@ version of the software.
|
||||
|
||||
## Types of updates
|
||||
|
||||
We include information here about a number of different update types you'll hear about, but the two overarching types which you have the most direct control over are *feature updates* and *quality updates*.
|
||||
We include information here about many different update types you'll hear about, but the two overarching types that you have the most direct control over are *feature updates* and *quality updates*.
|
||||
|
||||
- **Feature updates:** Released twice per year, during the first half and second half of each calendar year. Feature updates add new features and functionality to Windows 10. Because they are delivered frequently (rather than every 3-5 years), they are easier to manage.
|
||||
- **Quality updates:** Quality updates deliver both security and non-security fixes to Windows 10. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. They are typically released on the second Tuesday of each month, though they can be released at any time. The second-Tuesday releases are the ones that focus on security updates. Quality updates are *cumulative*, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update, including any out-of-band security fixes and any *servicing stack updates* that might have been released previously.
|
||||
- **Servicing stack updates:** The "servicing stack" is the code component that actually installs Windows updates. From time to time, the servicing stack itself needs to be updated in order to function smoothly. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. Servicing stack updates are not necessarily included in *every* monthly quality update, and occasionally are released out of band to address a late-breaking issue. Always install the latest available quality update to catch any servicing stack updates that might have been released. The servicing stack also contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). For more detail about servicing stack updates, see [Servicing stack updates](servicing-stack-updates.md).
|
||||
- **Driver updates**: These are updates to drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they are installed or not.
|
||||
- **Microsoft product updates:** These are updates for other Microsoft products, such as Office. You can enable or disable Microsoft updates by using policies controlled by various servicing tools.
|
||||
- **Driver updates**: These update drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they are installed or not.
|
||||
- **Microsoft product updates:** These update other Microsoft products, such as Office. You can enable or disable Microsoft updates by using policies controlled by various servicing tools.
|
||||
|
||||
|
||||
|
||||
## Servicing channels
|
||||
|
||||
Windows 10 offers three servicing channels, each of which offers you a different level of flexibility with how and when updates are delivered to devices. Using the different servicing channels allows you to deploy Windows 10 "as a service" which conceives of deployment as a continual process of updates which roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process.
|
||||
Windows 10 offers three servicing channels, each of which offers you a different level of flexibility with how and when updates are delivered to devices. Using the different servicing channels allows you to deploy Windows 10 "as a service," which conceives of deployment as a continual process of updates that roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process.
|
||||
|
||||
The first step of controlling when and how devices install updates is assigning them to the appropriate servicing channel. You can assign devices to a particular channel with any of several tools, including Microsoft Endpoint Configuration Manager, Windows Server Update Services (WSUS), and Group Policy settings applied by any of several means. By dividing devices into different populations ("deployment groups" or "rings") you can use servicing channel assignment, followed by other management features such as update deferral policies, to create a phased deployment of any update that allows you to start with a limited pilot deployment for testing before moving to a broad deployment throughout your organization.
|
||||
|
||||
@ -54,7 +54,7 @@ In the Semi-annual Channel, feature updates are available as soon as Microsoft r
|
||||
|
||||
### Windows Insider Program for Business
|
||||
|
||||
Insider preview releases are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features as well as compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. There are actually three options within the Windows Insider Program for Business channel:
|
||||
Insider preview releases are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. There are actually three options within the Windows Insider Program for Business channel:
|
||||
|
||||
- Windows Insider Fast
|
||||
- Windows Insider Slow
|
||||
@ -65,7 +65,7 @@ We recommend that you use the Windows Insider Release Preview channel for valida
|
||||
|
||||
### Long-term Servicing Channel
|
||||
|
||||
The **Long Term Servicing Channel** is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATMs. Devices on this channel receive new feature releases every two to three years. LTSB releases service a special LTSB edition of Windows 10 and are only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx).
|
||||
The **Long-Term Servicing Channel** is designed to be used only for specialized devices (which typically don't run Office) such as ones that control medical equipment or ATMs. Devices on this channel receive new feature releases every two to three years. LTSB releases service a special LTSB edition of Windows 10 and are only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx).
|
||||
|
||||
The Semi-Annual Channel is the default servicing channel for all Windows 10 devices except those with the LTSB edition installed. The following table shows the servicing channels available to each Windows 10 edition.
|
||||
|
||||
@ -85,7 +85,7 @@ The Semi-Annual Channel is the default servicing channel for all Windows 10 devi
|
||||
|
||||
Windows Server Update Services (WSUS): you set up a WSUS server, which downloads updates in bulk from Microsoft. Your individual devices then connect to your server to install their updates from there.
|
||||
|
||||
You can set up, control, and manage the server and update process with a number of tools:
|
||||
You can set up, control, and manage the server and update process with several tools:
|
||||
|
||||
- A standalone Windows Server Update Services server operated directly
|
||||
- [Configuration Manager](deploy-updates-configmgr.md)
|
||||
@ -95,7 +95,7 @@ For more information, see [Windows Server Update Services (WSUS)](https://docs.m
|
||||
|
||||
### Tools for cloud-based update delivery
|
||||
|
||||
Your individual devices connect to Microsoft endpoints directly to get the updates. The details of this process (how often devices download updates of various kinds, from which channels, deferrals, and details of the users' experience of installation) are set on devices either with Group Policy or MDM policies, which you can control with any of a number of tools:
|
||||
Your individual devices connect to Microsoft endpoints directly to get the updates. The details of this process (how often devices download updates of various kinds, from which channels, deferrals, and details of the users' experience of installation) are set on devices either with Group Policy or MDM policies, which you can control with any of several tools:
|
||||
|
||||
- [Group Policy Management Console](waas-wufb-group-policy.md) (Gpmc.msc)
|
||||
- [Microsoft Intune](waas-wufb-intune.md)
|
||||
|
||||
@ -38,7 +38,6 @@ Windows as a service provides a new way to think about building, deploying, and
|
||||
| [Assign devices to servicing branches for Windows 10 updates](https://docs.microsoft.com/windows/deployment/update/waas-servicing-channels-windows-10-updates) | Explains how to assign devices to the Semi-Annual Channel for feature and quality updates, and how to enroll devices in Windows Insider. |
|
||||
| [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | Explains how to use Update Compliance to monitor and manage Windows Updates on devices in your organization. |
|
||||
| [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | Explains the benefits of using Delivery Optimization or BranchCache for update distribution. |
|
||||
| [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) | Explains updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. |
|
||||
| [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) | Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune. |
|
||||
| [Deploy Windows 10 updates using Windows Server Update Services (WSUS)](waas-manage-updates-wsus.md) | Explains how to use WSUS to manage Windows 10 updates. |
|
||||
| [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | Explains how to use Configuration Manager to manage Windows 10 updates. |
|
||||
|
||||
@ -59,7 +59,6 @@ In addition to these steps, there is one requirement for WSUS to be able to use
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
|
||||
@ -30,7 +30,7 @@ You can use Group Policy or your mobile device management (MDM) service to confi
|
||||
> [!IMPORTANT]
|
||||
> Beginning with Windows 10, version 1903, organizations can use Windows Update for Business policies, regardless of the diagnostic data level chosen. If the diagnostic data level is set to **0 (Security)**, Windows Update for Business policies will still be honored. For instructions, see [Configure the operating system diagnostic data level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-levels).
|
||||
|
||||
Some Windows Update for Business policies are not applicable or behave differently for devices running Windows 10 Mobile Enterprise. Specifically, policies pertaining to Feature Updates will not be applied to Windows 10 Mobile Enterprise. All Windows 10 Mobile updates are recognized as Quality Updates, and can only be deferred or paused using the Quality Update policy settings. Additional information is provided in this topic and in [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md).
|
||||
Some Windows Update for Business policies are not applicable or behave differently for devices running Windows 10 Mobile Enterprise. Specifically, policies pertaining to Feature Updates will not be applied to Windows 10 Mobile Enterprise. All Windows 10 Mobile updates are recognized as Quality Updates, and can only be deferred or paused using the Quality Update policy settings. Additional information is provided in this topic.
|
||||
|
||||
## Start by grouping devices
|
||||
|
||||
@ -267,7 +267,6 @@ When a device running a newer version sees an update available on Windows Update
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md)
|
||||
|
||||
@ -253,7 +253,6 @@ If you suspect this is the problem, check Delivery Optimization settings that co
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
|
||||
@ -60,8 +60,7 @@ As Table 1 shows, each combination of servicing channel and deployment group is
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
|
||||
@ -101,8 +101,7 @@ For more information, see [Integration with Windows Update for Business in Windo
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md)
|
||||
|
||||
@ -350,8 +350,7 @@ Now that you have the **All Windows 10 Upgrades** view, complete the following s
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
|
||||
@ -1,77 +0,0 @@
|
||||
---
|
||||
title: Deploy updates to Windows 10 Mobile or Windows 10 IoT Mobile
|
||||
description: Deploy updates to devices in your organization that are running Windows 10 Mobile Enterprise or Windows 10 IoT Mobile.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10 Mobile
|
||||
- [Windows 10 IoT Mobile](https://www.microsoft.com/WindowsForBusiness/windows-iot)
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
>[!TIP]
|
||||
>If you're not familiar with the Windows 10 servicing or release channels, read [Servicing channels](waas-overview.md#servicing-channels) first.
|
||||
|
||||
Devices running Windows 10 Mobile and Windows 10 IoT Mobile receive updates from the Semi-annual Channel unless you [enroll the device in the Windows Insider Program](waas-servicing-channels-windows-10-updates.md#enroll-devices-in-the-windows-insider-program).
|
||||
|
||||
[Learn how to upgrade Windows 10 Mobile to Windows 10 Mobile Enterprise](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades)
|
||||
|
||||
|
||||
|
||||
| Windows 10 edition | Semi-annual Channel | Insider Program |
|
||||
| --- | --- | --- | --- |
|
||||
| Mobile |  |  |
|
||||
| Mobile Enterprise |  |  |
|
||||
| IoT Mobile |  |  |
|
||||
|
||||
|
||||
|
||||
Configuration of Windows 10 Mobile and Windows 10 IoT Mobile devices is limited to the feature set pertaining to quality updates only. That is, Windows Mobile feature updates are categorized the same as quality updates, and can only be deferred by setting the quality update deferral period, for a maximum period of 30 days. You can use mobile device management (MDM) to manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. Updates cannot be managed for Windows 10 Mobile.
|
||||
|
||||
|
||||
## Windows 10, version 1607
|
||||
|
||||
Only the following Windows Update for Business policies are supported for Windows 10 Mobile and Windows 10 IoT Mobile:
|
||||
|
||||
- ../Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel
|
||||
- ../Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatesInDays
|
||||
- ../Vendor/MSFT/Policy/Config/Update/PauseQualityUpdates
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md)
|
||||
- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure)
|
||||
- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
|
||||
- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md)
|
||||
- [Manage device restarts after updates](waas-restart.md)
|
||||
|
||||
|
||||
|
||||
@ -98,8 +98,7 @@ At this point, the download is complete and the update is ready to be installed.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
|
||||
@ -18,7 +18,6 @@ ms.topic: article
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 IoT Mobile
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
@ -67,7 +66,7 @@ To align with this new update delivery model, Windows 10 has three servicing cha
|
||||
There are currently two release channels for Windows 10:
|
||||
|
||||
- The **Semi-Annual Channel** receives feature updates twice per year.
|
||||
- The **Long Term Servicing Channel**, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years.
|
||||
- The **Long-Term Servicing Channel**, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>With each Semi-Annual Channel release, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion. This will enable you to gain access to new features, experiences, and integrated security as soon as possible. The "Semi-Annual Channel (Targeted)" designation is no longer used. For more information, see the blog post [Windows 10 and the "disappearing" SAC-T](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-and-the-disappearing-SAC-T/ba-p/199747).
|
||||
@ -101,7 +100,7 @@ In Windows 10, rather than receiving several updates each month and trying to fi
|
||||
|
||||
To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing channels to allow customers to designate how frequently their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity.
|
||||
|
||||
With that in mind, Windows 10 offers three servicing channels. The [Windows Insider Program](#windows-insider) provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update. The [Semi-Annual Channel](#semi-annual-channel) provides new functionality with twice-per-year feature update releases. Organizations can choose when to deploy updates from the Semi-Annual Channel. The [Long Term Servicing Channel](#long-term-servicing-channel), which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. For details about the versions in each servicing channel, see [Windows 10 release information](https://docs.microsoft.com/windows/release-health/release-information).
|
||||
With that in mind, Windows 10 offers three servicing channels. The [Windows Insider Program](#windows-insider) provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update. The [Semi-Annual Channel](#semi-annual-channel) provides new functionality with twice-per-year feature update releases. Organizations can choose when to deploy updates from the Semi-Annual Channel. The [Long-Term Servicing Channel](#long-term-servicing-channel), which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. For details about the versions in each servicing channel, see [Windows 10 release information](https://docs.microsoft.com/windows/release-health/release-information).
|
||||
|
||||
The concept of servicing channels is new, but organizations can use the same management tools they used to manage updates and upgrades in previous versions of Windows. For more information about the servicing tool options for Windows 10 and their capabilities, see [Servicing tools](#servicing-tools).
|
||||
|
||||
@ -129,7 +128,7 @@ Organizations are expected to initiate targeted deployment on Semi-Annual Channe
|
||||
Specialized systems—such as devices that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. It’s more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSC servicing model prevents Windows 10 Enterprise LTSB devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSB clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools.
|
||||
|
||||
> [!NOTE]
|
||||
> Windows 10 Enterprise LTSB is a separate Long Term Servicing Channel version.
|
||||
> Windows 10 Enterprise LTSB is a separate Long-Term Servicing Channel version.
|
||||
>
|
||||
> Long-term Servicing channel is not intended for deployment on most or all the devices in an organization; it should be used only for special-purpose devices. As a general guideline, a device with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it is better suited for the Semi-Annual servicing channel.
|
||||
|
||||
@ -197,8 +196,7 @@ With all these options, which an organization chooses depends on the resources,
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Quick guide to Windows as a service](waas-quick-start.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Quick guide to Windows as a service](waas-quick-start.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
|
||||
@ -24,12 +24,12 @@ Windows as a service is a new concept, introduced with the release of Windows 10
|
||||
## Definitions
|
||||
|
||||
Some new terms have been introduced as part of Windows as a service, so you should know what these terms mean.
|
||||
- **Feature updates** are released twice per year, around March and September. As the name suggests, these will add new features to Windows 10, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years.
|
||||
- **Feature updates** are released twice per year, around March and September. As the name suggests, these updates add new features to Windows 10, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years.
|
||||
- **Quality updates** deliver both security and non-security fixes. They are typically released on the second Tuesday of each month, though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they are important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md).
|
||||
- **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features as well as compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered.
|
||||
- **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and confirm compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered.
|
||||
- **Servicing channels** allow organizations to choose when to deploy new features.
|
||||
- The **Semi-Annual Channel** receives feature updates twice per year.
|
||||
- The **Long Term Servicing Channel**, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years.
|
||||
- The **Long-Term Servicing Channel**, which meant only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years.
|
||||
- **Deployment rings** are groups of devices used to initially pilot, and then to broadly deploy, each feature update in an organization.
|
||||
|
||||
See [Overview of Windows as a service](waas-overview.md) for more information.
|
||||
@ -42,19 +42,19 @@ Windows 10 gains new functionality with twice-per-year feature update releases.
|
||||
|
||||
All releases of Windows 10 have 18 months of servicing for all editions--these updates provide security and feature updates for the release. Customers running Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. These versions include Enterprise and Education editions for Windows 10, versions 1607 and later. Starting in October 2018, all Semi-Annual Channel releases in the September/October timeframe will also have the additional 12 months of servicing for a total of 30 months from the initial release. The Semi-Annual Channel versions released in March/April timeframe will continue to have an 18-month lifecycle.
|
||||
|
||||
Windows 10 Enterprise LTSB is a separate **Long Term Servicing Channel** version. Each release is supported for a total of 10 years (five years standard support, five years extended support). New releases are expected about every three years.
|
||||
Windows 10 Enterprise LTSB is a separate **Long-Term Servicing Channel** version. Each release is supported for a total of 10 years (five years standard support, five years extended support). New releases are expected about every three years.
|
||||
|
||||
See [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) for more information.
|
||||
For more information, see [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md).
|
||||
|
||||
## Staying up to date
|
||||
|
||||
The process for keeping Windows 10 up to date involves deploying a feature update, at an appropriate time after its release. A variety of management and update tools such as Windows Update, Windows Update for Business, Windows Server Update Services, Microsoft Endpoint Configuration Manager, and third-party products) can be used to help with this process. [Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started), a free tool to streamline Windows upgrade projects, is another important tool to help.
|
||||
The process for keeping Windows 10 up to date involves deploying a feature update, at an appropriate time after its release. You can use various management and update tools such as Windows Update, Windows Update for Business, Windows Server Update Services, Microsoft Endpoint Configuration Manager, and non-Microsoft products) to help with this process. [Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started), a free tool to streamline Windows upgrade projects, is another important tool to help.
|
||||
|
||||
Because app compatibility, both for desktop apps and web apps, is outstanding with Windows 10, extensive advanced testing isn’t required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin.
|
||||
|
||||
This process repeats with each new feature update, twice per year. These are small deployment projects, compared to the big projects that were necessary with the old three-to-five-year Windows release cycles.
|
||||
This process repeats with each new feature update, twice per year. These are small deployment projects, compared to the large projects that were necessary with the old three-to-five-year Windows release cycles.
|
||||
|
||||
Additional technologies such as BranchCache and Delivery Optimization, both peer-to-peer distribution tools, can help with the distribution of the feature update installation files.
|
||||
Other technologies such as BranchCache and Delivery Optimization, both peer-to-peer distribution tools, can help with the distribution of the feature update installation files.
|
||||
|
||||
See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) and [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) for more information.
|
||||
|
||||
@ -67,8 +67,7 @@ See [Build deployment rings for Windows 10 updates](waas-deployment-rings-window
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
|
||||
@ -200,7 +200,6 @@ There are three different registry combinations for controlling restart behavior
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Assign devices to servicing channels for Windows 10 updates (Windows 10)
|
||||
description: Learn how to assign devices to servicing channels for Windows 10 updates locally, by using Group Policy, and by using MDM .
|
||||
description: Learn how to assign devices to servicing channels for Windows 10 updates locally, by using Group Policy, and by using MDM
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
author: jaimeo
|
||||
@ -28,7 +28,7 @@ ms.custom:
|
||||
>
|
||||
>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel.
|
||||
|
||||
The Semi-Annual Channel is the default servicing channel for all Windows 10 devices except those with the LTSB edition installed. The following table shows the servicing channels available to each Windows 10 edition.
|
||||
The Semi-Annual Channel is the default servicing channel for all Windows 10 devices except devices with the LTSB edition installed. The following table shows the servicing channels available to each Windows 10 edition.
|
||||
|
||||
| Windows 10 edition | Semi-Annual Channel | Long-Term Servicing Channel | Insider Program |
|
||||
| --- | --- | --- | --- |
|
||||
@ -63,7 +63,7 @@ The Semi-Annual Channel is the default servicing channel for all Windows 10 devi
|
||||
|
||||
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** - enable policy and set branch readiness level to the Semi-Annual Channel
|
||||
|
||||
**To assign devices to to the Semi-Annual Channel by using MDM**
|
||||
**To assign devices to the Semi-Annual Channel by using MDM**
|
||||
|
||||
|
||||
- In Windows 10, version 1607 and later releases:
|
||||
@ -79,10 +79,10 @@ The Semi-Annual Channel is the default servicing channel for all Windows 10 devi
|
||||
|
||||
## Enroll devices in the Windows Insider Program
|
||||
|
||||
To get started with the Windows Insider Program for Business, you will need to follow a few simple steps:
|
||||
To get started with the Windows Insider Program for Business, you will need to follow a few steps:
|
||||
|
||||
1. On the [Windows Insider](https://insider.windows.com) website, go to **For Business > Getting Started** to [register your organizational Azure AD account](https://insider.windows.com/insidersigninaad/).
|
||||
2. **Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/for-business-organization-admin/) and control settings centrally.</br>**Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain.
|
||||
2. **Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can [register their domain](https://insider.windows.com/for-business-organization-admin/) and control settings centrally.</br>**Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain.
|
||||
3. Make sure the **Allow Telemetry** setting is set to **2** or higher.
|
||||
4. Starting with Windows 10, version 1709, set policies to manage preview builds and their delivery:
|
||||
|
||||
@ -90,7 +90,7 @@ The **Manage preview builds** setting gives administrators control over enabling
|
||||
* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business** - *Manage preview builds*
|
||||
* MDM: **Update/ManagePreviewBuilds**
|
||||
|
||||
The **Branch Readiness Level** settings allows you to choose between preview flight rings, and allows you to defer or pause the delivery of updates.
|
||||
The **Branch Readiness Level** settings allow you to choose between preview flight rings, and allows you to defer or pause the delivery of updates.
|
||||
* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business** - *Select when Preview Builds and Feature Updates are received*
|
||||
* MDM: **Update/BranchReadinessLevel**
|
||||
|
||||
@ -164,7 +164,7 @@ During the life of a device, it might be necessary or desirable to switch betwee
|
||||
|
||||
In Windows 10, administrators can control user access to Windows Update.
|
||||
|
||||
Administrators can disable the "Check for updates" option for users by enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features** . Any background update scans, downloads and installations will continue to work as configured. We don't recomment this setting if you have configured the device to "notify" to download or install as this policy will prevent the user from being able to do so.
|
||||
Administrators can disable the "Check for updates" option for users by enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features**. Any background update scans, downloads, and installations will continue to work as configured. We don't recomment this setting if you have configured the device to "notify" to download or install as this policy will prevent the user from being able to do so.
|
||||
|
||||
>[!NOTE]
|
||||
> Starting with Windows 10, any Group Policy user configuration settings for Windows Update are no longer supported.
|
||||
@ -182,8 +182,7 @@ Administrators can disable the "Check for updates" option for users by enabling
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
|
||||
@ -22,30 +22,30 @@ ms.collection: m365initiative-coredeploy
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
In the past, traditional Windows deployments tended to be large, lengthy, and expensive. Windows 10 offers a new approach to deploying both quality and feature updates, making the process much simpler and therefore the planning much more straightforward. With Windows as a service, the methodology around updating Windows has completely changed, moving away from major upgrades every few years to iterative updates twice per year. Each iteration contains a smaller subset of changes so that they won’t seem like substantial differences, like they do today. This image illustrates the level of effort needed for traditional Windows deployments versus servicing Windows 10 and how it is now spread evenly over time versus spiking every few years.
|
||||
In the past, traditional Windows deployments tended to be large, lengthy, and expensive. Windows 10 offers a new approach to deploying both quality and feature updates, making the process much simpler and therefore the planning much more straightforward. With Windows as a service, the methodology around updating Windows has changed, moving away from major upgrades every few years to iterative updates twice per year. Each iteration contains a smaller subset of changes so that they won’t seem like substantial differences, like they do today. This image illustrates the level of effort needed for traditional Windows deployments versus servicing Windows 10 and how it is now spread evenly over time versus spiking every few years.
|
||||
|
||||
|
||||
|
||||
|
||||
Windows 10 spreads the traditional deployment effort of a Windows upgrade, which typically occurred every few years, over smaller, continuous updates. With this change, you must approach the ongoing deployment and servicing of Windows differently. A strong Windows 10 deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update. Here’s an example of what this process might look like:
|
||||
|
||||
- **Configure test devices.** Configure test devices in the Windows Insider Program so that Insiders can test feature updates before they’re available to the Semi-Annual Channel. Typically, this would be a small number of test devices that IT staff members use to evaluate pre-release builds of Windows. Microsoft provides current development builds to Windows Insider members approximately every week so that interested users can see the functionality Microsoft is adding. See the section Windows Insider for details on how to enroll in the Windows Insider Program on a Windows 10 device.
|
||||
- **Configure test devices.** Configure test devices in the Windows Insider Program so that Insiders can test feature updates before they’re available to the Semi-Annual Channel. Typically, this population would be a few test devices that IT staff members use to evaluate pre-release builds of Windows. Microsoft provides current development builds to Windows Insider members approximately every week so that interested users can see the functionality Microsoft is adding. See the section Windows Insider for details on how to enroll in the Windows Insider Program on a Windows 10 device.
|
||||
- **Identify excluded devices.** For some organizations, special-purpose devices such as those used to control factory or medical equipment or run ATMs require a stricter, less frequent feature update cycle than the Semi-Annual Channel can offer. For those machines, you must install Windows 10 Enterprise LTSB to avoid feature updates for up to 10 years. Identify these devices, and separate them from the phased deployment and servicing cycles to help remove confusion for your administrators and ensure that devices are handled correctly.
|
||||
- **Recruit volunteers.** The purpose of testing a deployment is to receive feedback. One effective way to recruit pilot users is to request volunteers. When doing so, clearly state that you’re looking for feedback rather than people to just “try it out” and that there could be occasional issues involved with accepting feature updates right away. With Windows as a service, the expectation is that there should be few issues, but if an issue does arise, you want testers to let you know as soon as possible. When considering whom to recruit for pilot groups, be sure to include members who provide the broadest set of applications and devices to validate the largest number of apps and devices possible.
|
||||
- **Update Group Policy.** Each feature update includes new group policies to manage new features. If you use Group Policy to manage devices, the Group Policy Admin for the Active Directory domain will need to download a .admx package and copy it to their [Central Store](https://support.microsoft.com/help/929841/how-to-create-the-central-store-for-group-policy-administrative-templa) (or to the [PolicyDefinitions](https://msdn.microsoft.com/library/bb530196.aspx) directory in the SYSVOL folder of a domain controller if not using a Central Store). Always manage new group polices from the version of Windows 10 they shipped with by using the Remote Server Administration Tools. The ADMX download package is created at the end of each development cycle and then posted for download. To find the ADMX download package for a given Windows build, search for “ADMX download for Windows build xxxx”. For details about Group Policy management, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra)
|
||||
- **Update Group Policy.** Each feature update includes new group policies to manage new features. If you use Group Policy to manage devices, the Group Policy Admin for the Active Directory domain will need to download an .admx package and copy it to their [Central Store](https://support.microsoft.com/help/929841/how-to-create-the-central-store-for-group-policy-administrative-templa) (or to the [PolicyDefinitions](https://msdn.microsoft.com/library/bb530196.aspx) directory in the SYSVOL folder of a domain controller if not using a Central Store). Always manage new group policies from the version of Windows 10 they shipped with by using the Remote Server Administration Tools. The ADMX download package is created at the end of each development cycle and then posted for download. To find the ADMX download package for a given Windows build, search for “ADMX download for Windows build xxxx”. For details about Group Policy management, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra)
|
||||
- **Choose a servicing tool.** Decide which product you’ll use to manage the Windows updates in your environment. If you’re currently using Windows Server Update Services (WSUS) or Microsoft Endpoint Manager to manage your Windows updates, you can continue using those products to manage Windows 10 updates. Alternatively, you can use Windows Update for Business. In addition to which product you’ll use, consider how you’ll deliver the updates. With Windows 10, multiple peer-to-peer options are available to make update distribution faster. For a comparison of tools, see [Servicing tools](waas-overview.md#servicing-tools).
|
||||
- **Prioritize applications.** First, create an application portfolio. This list should include everything installed in your organization and any webpages your organization hosts. Next, prioritize this list to identify those that are the most business critical. Because the expectation is that application compatibility with Windows 10 will be high, only the most business critical applications should be tested before the pilot phase; everything else can be tested afterwards. For more information about identifying compatibility issues withe applications, see [Manage Windows upgrades with Upgrade Analytics](../upgrade/manage-windows-upgrades-with-upgrade-readiness.md).
|
||||
- **Prioritize applications.** First, create an application portfolio. This list should include everything installed in your organization and any webpages your organization hosts. Next, prioritize this list to identify those apps that are the most business critical. Because the expectation is that application compatibility with Windows 10 will be high, only the most business critical applications should be tested before the pilot phase; everything else can be tested afterwards. For more information about identifying compatibility issues withe applications, see [Manage Windows upgrades with Upgrade Analytics](../upgrade/manage-windows-upgrades-with-upgrade-readiness.md).
|
||||
|
||||
> [!NOTE]
|
||||
> This strategy is applicable to approaching an environment in which Windows 10 already exists. For information about how to deploy or upgrade to Windows 10 where another version of Windows exists, see [Plan for Windows 10 deployment](../planning/index.md).
|
||||
>
|
||||
> Windows 10 Enterprise LTSC is a separate Long Term Servicing Channel version.
|
||||
> Windows 10 Enterprise LTSC is a separate Long-Term Servicing Channel version.
|
||||
|
||||
Each time Microsoft releases a Windows 10 feature update, the IT department should use the following high-level process to help ensure that the broad deployment is successful:
|
||||
|
||||
1. **Validate compatibility of business critical apps.** Test your most important business-critical applications for compatibility with the new Windows 10 feature update running on your Windows Insider machines identified in the earlier “Configure test machines” step of the Predeployment strategy section. The list of applications involved in this validation process should be small because most applications can be tested during the pilot phase. For more information about device and application compatibility in Windows 10, see the section Compatibility.
|
||||
2. **Target and react to feedback.** With Windows 10, Microsoft expects application and device compatibility to be high, but it’s still important to have targeted groups within both the IT department and business units to verify application compatibility for the remaining applications in your application portfolio. Because only the most business-critical applications are tested beforehand, this will represent the majority of application compatibility testing in your environment. This should not necessarily be a formal process but rather user validation through the use of a particular application. So, the next step is to deploy the feature update to early-adopting IT users and your targeted groups running in the Semi-Annual channel that you identified in the “Recruit volunteers” step of the Predeployment strategy section. Be sure to communicate clearly that you’re looking for feedback as soon as possible, and state exactly how users can submit feedback to you. Should an issue arise, have a remediation plan in place to address it.
|
||||
3. **Deploy broadly.** Finally, focus on the large-scale deployment using deployment rings, like the ones discussed in Table 1. Build deployment rings that target groups of computers in your selected update-management product. To reduce risk as much as possible, construct your deployment rings in a way that splits individual departments into multiple rings. This way, if you were to encounter an issue, you don’t prevent any critical business from continuing. By using this method, each deployment ring reduces risk as more and more people have been updated in any particular department.
|
||||
2. **Target and react to feedback.** With Windows 10, Microsoft expects application and device compatibility to be high, but it’s still important to have targeted groups within both the IT department and business units to verify application compatibility for the remaining applications in your application portfolio. Because only the most business-critical applications are tested beforehand, this activity will represent most of the application compatibility testing in your environment. It shouldn't necessarily be a formal process but rather user validation by using a particular application. So, the next step is to deploy the feature update to early-adopting IT users and your targeted groups running in the Semi-Annual channel that you identified in the “Recruit volunteers” step of the Predeployment strategy section. Be sure to communicate clearly that you’re looking for feedback as soon as possible, and state exactly how users can submit feedback to you. Should an issue arise, have a remediation plan in place to address it.
|
||||
3. **Deploy broadly.** Finally, focus on the large-scale deployment using deployment rings, like the ones discussed in Table 1. Build deployment rings that target groups of computers in your selected update-management product. To reduce risk as much as possible, construct your deployment rings in a way that splits individual departments into multiple rings. This way, if you were to encounter an issue, you don’t prevent any critical business from continuing. By using this method, each deployment ring reduces risk as more people have been updated in any particular department.
|
||||
|
||||
|
||||
## Steps to manage updates for Windows 10
|
||||
@ -62,8 +62,7 @@ Each time Microsoft releases a Windows 10 feature update, the IT department shou
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
|
||||
@ -252,7 +252,6 @@ HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\
|
||||
|
||||
- [Update Windows 10 in the enterprise](index.md)
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
|
||||
@ -205,8 +205,7 @@ If you use Windows Server Update Server (WSUS), you can prevent users from scann
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
|
||||
@ -203,7 +203,6 @@ If you use Windows Server Update Server (WSUS), you can prevent users from scann
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
|
||||
@ -275,8 +275,7 @@ You have now configured the **Ring 4 Broad business users** deployment ring to r
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
|
||||
- [Configure Windows Update for Business](waas-configure-wufb.md)
|
||||
- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md)
|
||||
|
||||
@ -31,7 +31,7 @@ The following table describes the log files created by Windows Update.
|
||||
To merge and convert Windows Update trace files (.etl files) into a single readable WindowsUpdate.log file, see [Get-WindowsUpdateLog](https://docs.microsoft.com/powershell/module/windowsupdate/get-windowsupdatelog?view=win10-ps&preserve-view=tru).
|
||||
|
||||
>[!NOTE]
|
||||
>When you run the **Get-WindowsUpdateLog** cmdlet, an copy of WindowsUpdate.log file is created as a static log file. It does not update as the old WindowsUpate.log unless you run **Get-WindowsUpdateLog** again.
|
||||
>When you run the **Get-WindowsUpdateLog** cmdlet, an copy of WindowsUpdate.log file is created as a static log file. It does not update as the old WindowsUpdate.log unless you run **Get-WindowsUpdateLog** again.
|
||||
|
||||
### Windows Update log components
|
||||
The Windows Update engine has different component names. The following are some of the most common components that appear in the WindowsUpdate.log file:
|
||||
|
||||
@ -32,25 +32,28 @@ Deployment instructions are provided for the following scenarios:
|
||||
- VMs must be running Windows 10 Pro, version 1703 (also known as the Creator's Update) or later.
|
||||
- VMs must be Active Directory-joined or Azure Active Directory (AAD)-joined.
|
||||
- VMs must be generation 1.
|
||||
- VMs must hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH).
|
||||
- VMs must be hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH).
|
||||
|
||||
## Activation
|
||||
|
||||
### Scenario 1
|
||||
|
||||
- The VM is running Windows 10, version 1803 or later.
|
||||
- The VM is hosted in Azure or another [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH).
|
||||
|
||||
When a user with VDA rights signs in to the VM using their AAD credentials, the VM is automatically stepped-up to Enterprise and activated. There is no need to perform Windows 10 Pro activation. This eliminates the need to maintain KMS or MAK in the qualifying cloud infrastructure.
|
||||
|
||||
### Scenario 2
|
||||
|
||||
- The Hyper-V host and the VM are both running Windows 10, version 1803 or later.
|
||||
|
||||
[Inherited Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation#inherited-activation) is enabled. All VMs created by a user with a Windows 10 E3 or E5 license are automatically activated independent of whether a user signs in with a local account or using an Azure Active Directory account.
|
||||
|
||||
### Scenario 3
|
||||
|
||||
- The VM is running Windows 10, version 1703 or 1709, or the hoster is not an authorized [QMTH](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) partner.
|
||||
|
||||
In this scenario, the underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise. Activation is accomplished using a Windows 10 Pro Generic Volume License Key (GVLK) and a Volume License KMS activation server provided by the hoster. Alternatively, a KMS activation server on your corporate network can be used if you have configured a private connection, such as [ExpressRoute](https://azure.microsoft.com/services/expressroute/) or [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/).
|
||||
In this scenario, the underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise. Activation is accomplished using a Windows 10 Pro Generic Volume License Key (GVLK) and a Volume License KMS activation server provided by the hoster. Alternatively, a KMS activation server can be used. KMS activation is provided for Azure VMs. For more information, see [Troubleshoot Azure Windows virtual machine activation problems](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/troubleshoot-activation-problems).
|
||||
|
||||
For examples of activation issues, see [Troubleshoot the user experience](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#troubleshoot-the-user-experience).
|
||||
|
||||
@ -69,7 +72,7 @@ For examples of activation issues, see [Troubleshoot the user experience](https:
|
||||
6. Follow the instructions to use sysprep at [Steps to generalize a VHD](https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image#steps-to-generalize-a-vhd) and then start the VM again.
|
||||
7. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps to use Windows Configuration Designer and inject an activation key. Otherwise, skip to step 20.
|
||||
8. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd).
|
||||
9. Open Windows Configuration Designer and click **Provison desktop services**.
|
||||
9. Open Windows Configuration Designer and click **Provision desktop services**.
|
||||
10. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name.
|
||||
- Note: You can use a different project name, but this name is also used with dism.exe in a subsequent step.
|
||||
11. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**.
|
||||
@ -111,7 +114,7 @@ For Azure AD-joined VMs, follow the same instructions (above) as for [Active Dir
|
||||
3. On the Remote tab, choose **Allow remote connections to this computer** and then click **Select Users**.
|
||||
4. Click **Add**, type **Authenticated users**, and then click **OK** three times.
|
||||
5. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd).
|
||||
6. Open Windows Configuration Designer and click **Provison desktop services**.
|
||||
6. Open Windows Configuration Designer and click **Provision desktop services**.
|
||||
7. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 8.
|
||||
1. Under **Name**, type **Desktop Bulk Enrollment Token Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name.
|
||||
2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**.
|
||||
|
||||
@ -55,7 +55,7 @@ Applies to:
|
||||
Windows Hello for Business uses smart card based authentication for many operations. Smart card has special guidelines when using a third-party CA for certificate issuance, some of which apply to the domain controllers. Not all Windows Hello for Business deployment types require these configurations. Accessing on-premises resources from an Azure AD Joined device does require special configuration when using a third-party CA to issue domain controller certificates.
|
||||
|
||||
For more information, read [Guidelines for enabling smart card logon with third-party certification authorities](
|
||||
https://support.microsoft.com/topic/a34a400a-51d5-f2a1-c8c0-7a6c9c49cb78).
|
||||
https://docs.microsoft.com/troubleshoot/windows-server/windows-security/enabling-smart-card-logon-third-party-certification-authorities).
|
||||
|
||||
### Identifying On-premises Resource Access Issues with Third-Party CAs
|
||||
|
||||
|
||||
@ -109,7 +109,9 @@ On-premises deployments provide users with the ability to reset forgotten PINs e
|
||||
3. Follow the instructions provided by the provisioning process
|
||||
4. When finished, unlock your desktop using your newly created PIN.
|
||||
|
||||
>[!NOTE]
|
||||
You may find that PIN reset from settings only works post login, and that the "lock screen" PIN reset function will not work if you have any matching limitation of SSPR password reset from the lock screen. For more information, see [Enable Azure Active Directory self-service password reset at the Windows sign-in screen - **General limitations**](https://docs.microsoft.com/azure/active-directory/authentication/howto-sspr-windows#general-limitations).
|
||||
|
||||
> [!NOTE]
|
||||
> Visit the [Windows Hello for Business Videos](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos.md) page and watch the [Windows Hello for Business forgotten PIN user experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience) video.
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -396,7 +396,7 @@ Certificate enrollment for Azure AD joined devices occurs over the Internet. As
|
||||
|
||||
Ideally, you configure your Microsoft Intune SCEP certificate profile to use multiple external NDES URLs. This enables Microsoft Intune to round-robin load balance the certificate requests to identically configured NDES Servers (each NDES server can accommodate approximately 300 concurrent requests). Microsoft Intune sends these requests to Azure AD Application Proxies.
|
||||
|
||||
Azure AD Application proxies are serviced by lightweight Application Proxy Connector agents. These agents are installed on your on-premises, domain joined devices and make authenticated secure outbound connection to Azure, waiting to process requests from Azure AD Application Proxies. You can create connector groups in Azure Active Directory to assign specific connectors to service specific applications.
|
||||
Azure AD Application proxies are serviced by lightweight Application Proxy Connector agents. See [What is Application Proxy](https://docs.microsoft.com/azure/active-directory/manage-apps/application-proxy#what-is-application-proxy) for more details. These agents are installed on your on-premises, domain joined devices and make authenticated secure outbound connection to Azure, waiting to process requests from Azure AD Application Proxies. You can create connector groups in Azure Active Directory to assign specific connectors to service specific applications.
|
||||
|
||||
Connector group automatically round-robin, load balance the Azure AD Application proxy requests to the connectors within the assigned connector group. This ensures Windows Hello for Business certificate requests have multiple dedicated Azure AD Application Proxy connectors exclusively available to satisfy enrollment requests. Load balancing the NDES servers and connectors should ensure users enroll their Windows Hello for Business certificates in a timely manner.
|
||||
|
||||
|
||||
@ -298,7 +298,13 @@ Sign-in the domain controller or administrative workstation with domain administ
|
||||
3. In the navigation pane, select the node that has the name of your internal Active Directory domain name.
|
||||
4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**.
|
||||
5. In the **name** box, type the name of the federation service. In the **IP address** box, type the IP address of your federation server. Click **Add Host**.
|
||||
6. Close the DNS Management console
|
||||
6. Right-click the `domain_name` node and select **New Alias (CNAME)**.
|
||||
7. In the **New Resource Record** dialog box, type "enterpriseregistration" in the **Alias** name box.
|
||||
8. In the **fully qualified domain name (FQDN)** of the target host box, type `federation_service_farm_name.domain_name.com`, and click OK.
|
||||
9. Close the DNS Management console.
|
||||
|
||||
> [!NOTE]
|
||||
> If your forest has multiple UPN suffixes, please make sure that `enterpriseregistration.upnsuffix.com` is present for each suffix.
|
||||
|
||||
## Configure the Intranet Zone to include the federation service
|
||||
|
||||
@ -342,5 +348,3 @@ Before you continue with the deployment, validate your deployment progress by re
|
||||
3. Prepare and Deploy Windows Server 2016 Active Directory Federation Services (*You are here*)
|
||||
4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md)
|
||||
5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md)
|
||||
|
||||
|
||||
|
||||
@ -181,7 +181,7 @@ mstsc.exe /remoteGuard
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> The user must be part of administrators group.
|
||||
> The user must be authorized to connect to the remote server using Remote Desktop Protocol, for example by being a member of the Remote Desktop Users local group on the remote computer.
|
||||
|
||||
## Considerations when using Windows Defender Remote Credential Guard
|
||||
|
||||
|
||||
@ -11,4 +11,4 @@ ms.topic: include
|
||||
---
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The improved [Microsoft 365 security center](https://security.microsoft.com) is now available in public preview. This new experience brings Defender for Endpoint, Defender for Office, 365 Microsoft 365 Defender, and more into the Microsoft 365 security center. [Learn what's new](https://docs.microsoft.com/microsoft-365/security/mtp/overview-security-center). This topic might apply to both Microsoft Defender for Endpoint and Microsoft 365 Defender. Refer to the **Applies To** section and look for specific call outs in this article where there might be differences.
|
||||
> The improved [Microsoft 365 security center](https://security.microsoft.com) is now available in public preview. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 security center. [Learn what's new](https://docs.microsoft.com/microsoft-365/security/mtp/overview-security-center). This topic might apply to both Microsoft Defender for Endpoint and Microsoft 365 Defender. Refer to the **Applies To** section and look for specific call outs in this article where there might be differences.
|
||||
|
||||
@ -1,82 +1,11 @@
|
||||
# [Threat protection](index.md)
|
||||
|
||||
## [Evaluate capabilities](microsoft-defender-atp/evaluation-lab.md)
|
||||
|
||||
## [Plan deployment](microsoft-defender-atp/deployment-strategy.md)
|
||||
|
||||
## [Deployment guide]()
|
||||
### [Deployment phases](microsoft-defender-atp/deployment-phases.md)
|
||||
### [Phase 1: Prepare](microsoft-defender-atp/prepare-deployment.md)
|
||||
### [Phase 2: Set up](microsoft-defender-atp/production-deployment.md)
|
||||
### [Phase 3: Onboard]()
|
||||
#### [Onboarding overview](microsoft-defender-atp/onboarding.md)
|
||||
#### [Deployment rings](microsoft-defender-atp/deployment-rings.md)
|
||||
#### [Onboarding using Microsoft Endpoint Configuration Manager](microsoft-defender-atp/onboarding-endpoint-configuration-manager.md)
|
||||
#### [Onboarding using Microsoft Endpoint Manager](microsoft-defender-atp/onboarding-endpoint-manager.md)
|
||||
#### [Onboard supported devices](microsoft-defender-atp/onboard-configure.md)
|
||||
|
||||
## [Migration guides](microsoft-defender-atp/migration-guides.md)
|
||||
### [Switch from McAfee to Microsoft Defender for Endpoint]()
|
||||
#### [Overview of migration](microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md)
|
||||
#### [Phase 1: Prepare](microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md)
|
||||
#### [Phase 2: Setup](microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md)
|
||||
#### [Phase 3: Onboard](microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md)
|
||||
### [Switch from Symantec to Microsoft Defender for Endpoint]()
|
||||
#### [Overview of migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md)
|
||||
#### [Phase 1: Prepare](microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md)
|
||||
#### [Phase 2: Setup](microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md)
|
||||
#### [Phase 3: Onboard](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md)
|
||||
### [Switch from your non-Microsoft endpoint security solution to Microsoft Defender for Endpoint]()
|
||||
#### [Overview of migration](microsoft-defender-atp/switch-to-microsoft-defender-migration.md)
|
||||
#### [Phase 1: Prepare](microsoft-defender-atp/switch-to-microsoft-defender-prepare.md)
|
||||
#### [Phase 2: Setup](microsoft-defender-atp/switch-to-microsoft-defender-setup.md)
|
||||
#### [Phase 3: Onboard](microsoft-defender-atp/switch-to-microsoft-defender-onboard.md)
|
||||
### [Manage Microsoft Defender for Endpoint after migration]()
|
||||
#### [Overview of managing Microsoft Defender for Endpoint](microsoft-defender-atp/manage-atp-post-migration.md)
|
||||
#### [Intune (recommended)](microsoft-defender-atp/manage-atp-post-migration-intune.md)
|
||||
#### [Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md)
|
||||
#### [Group Policy Objects](microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md)
|
||||
#### [PowerShell, WMI, and MPCmdRun.exe](microsoft-defender-atp/manage-atp-post-migration-other-tools.md)
|
||||
|
||||
## [Security administration]()
|
||||
### [Threat & vulnerability management]()
|
||||
#### [Overview](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
|
||||
#### [Get started]()
|
||||
##### [Permissions & prerequisites](microsoft-defender-atp/tvm-prerequisites.md)
|
||||
##### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md)
|
||||
##### [Assign device value](microsoft-defender-atp/tvm-assign-device-value.md)
|
||||
#### [Assess your security posture]()
|
||||
##### [Dashboard insights](microsoft-defender-atp/tvm-dashboard-insights.md)
|
||||
##### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md)
|
||||
##### [Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md)
|
||||
#### [Improve your security posture & reduce risk]()
|
||||
##### [Address security recommendations](microsoft-defender-atp/tvm-security-recommendation.md)
|
||||
##### [Remediate vulnerabilities](microsoft-defender-atp/tvm-remediation.md)
|
||||
##### [Exceptions for security recommendations](microsoft-defender-atp/tvm-exception.md)
|
||||
##### [Plan for end-of-support software](microsoft-defender-atp/tvm-end-of-support-software.md)
|
||||
##### [Mitigate zero-day vulnerabilities](microsoft-defender-atp/tvm-zero-day-vulnerabilities.md)
|
||||
#### [Understand vulnerabilities on your devices]()
|
||||
##### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md)
|
||||
##### [Vulnerabilities in my organization](microsoft-defender-atp/tvm-weaknesses.md)
|
||||
##### [Event timeline](microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md)
|
||||
##### [Vulnerable devices report](microsoft-defender-atp/tvm-vulnerable-devices-report.md)
|
||||
##### [Hunt for exposed devices](microsoft-defender-atp/tvm-hunt-exposed-devices.md)
|
||||
|
||||
|
||||
### [Attack surface reduction]()
|
||||
#### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md)
|
||||
#### [Evaluate attack surface reduction rules](microsoft-defender-atp/evaluate-attack-surface-reduction.md)
|
||||
#### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md)
|
||||
#### [Attack surface reduction FAQ](microsoft-defender-atp/attack-surface-reduction-faq.md)
|
||||
|
||||
#### [Attack surface reduction controls]()
|
||||
##### [Attack surface reduction rules](microsoft-defender-atp/attack-surface-reduction.md)
|
||||
##### [Enable attack surface reduction rules](microsoft-defender-atp/enable-attack-surface-reduction.md)
|
||||
##### [Customize attack surface reduction rules](microsoft-defender-atp/customize-attack-surface-reduction.md)
|
||||
##### [View attack surface reduction events](microsoft-defender-atp/event-views.md)
|
||||
|
||||
#### [Hardware-based isolation]()
|
||||
##### [Hardware-based isolation in Windows 10](microsoft-defender-atp/overview-hardware-based-isolation.md)
|
||||
|
||||
##### [Hardware-based isolation evaluation](microsoft-defender-application-guard/test-scenarios-md-app-guard.md)
|
||||
|
||||
##### [Application isolation]()
|
||||
@ -97,41 +26,10 @@
|
||||
##### [Control USB devices](device-control/control-usb-devices-using-intune.md)
|
||||
##### [Device control report](device-control/device-control-report.md)
|
||||
|
||||
#### [Exploit protection]()
|
||||
##### [Protect devices from exploits](microsoft-defender-atp/exploit-protection.md)
|
||||
##### [Exploit protection evaluation](microsoft-defender-atp/evaluate-exploit-protection.md)
|
||||
##### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md)
|
||||
##### [Customize exploit protection](microsoft-defender-atp/customize-exploit-protection.md)
|
||||
##### [Import, export, and deploy exploit protection configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md)
|
||||
##### [Troubleshoot exploit protection mitigations](microsoft-defender-atp/troubleshoot-exploit-protection-mitigations.md)
|
||||
##### [Exploit protection reference](microsoft-defender-atp/exploit-protection-reference.md )
|
||||
|
||||
#### [Network protection]()
|
||||
##### [Protect your network](microsoft-defender-atp/network-protection.md)
|
||||
##### [Evaluate network protection](microsoft-defender-atp/evaluate-network-protection.md)
|
||||
##### [Turn on network protection](microsoft-defender-atp/enable-network-protection.md)
|
||||
|
||||
#### [Web protection]()
|
||||
##### [Web protection overview](microsoft-defender-atp/web-protection-overview.md)
|
||||
##### [Web threat protection]()
|
||||
###### [Web threat protection overview](microsoft-defender-atp/web-threat-protection.md)
|
||||
###### [Monitor web security](microsoft-defender-atp/web-protection-monitoring.md)
|
||||
###### [Respond to web threats](microsoft-defender-atp/web-protection-response.md)
|
||||
##### [Web content filtering](microsoft-defender-atp/web-content-filtering.md)
|
||||
|
||||
#### [Controlled folder access]()
|
||||
##### [Protect folders](microsoft-defender-atp/controlled-folders.md)
|
||||
##### [Evaluate controlled folder access](microsoft-defender-atp/evaluate-controlled-folder-access.md)
|
||||
##### [Enable controlled folder access](microsoft-defender-atp/enable-controlled-folders.md)
|
||||
##### [Customize controlled folder access](microsoft-defender-atp/customize-controlled-folders.md)
|
||||
|
||||
|
||||
|
||||
#### [Network firewall]()
|
||||
##### [Network firewall overview](windows-firewall/windows-firewall-with-advanced-security.md)
|
||||
##### [Network firewall evaluation](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md)
|
||||
|
||||
|
||||
### [Next-generation protection]()
|
||||
#### [Next-generation protection overview](microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md)
|
||||
#### [Evaluate next-generation protection](microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus.md)
|
||||
@ -220,506 +118,14 @@
|
||||
#### [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md)
|
||||
#### [Better together: Microsoft Defender Antivirus and Office 365](microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md)
|
||||
|
||||
|
||||
### [Microsoft Defender for Endpoint for Mac]()
|
||||
#### [Overview of Microsoft Defender for Endpoint for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md)
|
||||
#### [What's New](microsoft-defender-atp/mac-whatsnew.md)
|
||||
|
||||
#### [Deploy]()
|
||||
##### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md)
|
||||
##### [JAMF Pro-based deployment]()
|
||||
###### [Deploying Microsoft Defender for Endpoint for macOS using Jamf Pro](microsoft-defender-atp/mac-install-with-jamf.md)
|
||||
###### [Login to Jamf Pro](microsoft-defender-atp/mac-install-jamfpro-login.md)
|
||||
###### [Set up device groups](microsoft-defender-atp/mac-jamfpro-device-groups.md)
|
||||
###### [Set up policies](microsoft-defender-atp/mac-jamfpro-policies.md)
|
||||
###### [Enroll devices](microsoft-defender-atp/mac-jamfpro-enroll-devices.md)
|
||||
|
||||
##### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md)
|
||||
##### [Manual deployment](microsoft-defender-atp/mac-install-manually.md)
|
||||
#### [Update](microsoft-defender-atp/mac-updates.md)
|
||||
|
||||
#### [Configure]()
|
||||
##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md)
|
||||
##### [Set preferences](microsoft-defender-atp/mac-preferences.md)
|
||||
##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md)
|
||||
##### [Schedule scans](microsoft-defender-atp/mac-schedule-scan-atp.md)
|
||||
|
||||
#### [Troubleshoot]()
|
||||
##### [Troubleshoot installation issues](microsoft-defender-atp/mac-support-install.md)
|
||||
##### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md)
|
||||
##### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md)
|
||||
##### [Troubleshoot license issues](microsoft-defender-atp/mac-support-license.md)
|
||||
|
||||
#### [Privacy](microsoft-defender-atp/mac-privacy.md)
|
||||
#### [Resources](microsoft-defender-atp/mac-resources.md)
|
||||
|
||||
|
||||
|
||||
|
||||
### [Microsoft Defender for Endpoint for iOS]()
|
||||
#### [Overview of Microsoft Defender for Endpoint for iOS](microsoft-defender-atp/microsoft-defender-atp-ios.md)
|
||||
|
||||
#### [Deploy]()
|
||||
##### [Deploy Microsoft Defender for Endpoint for iOS via Intune](microsoft-defender-atp/ios-install.md)
|
||||
|
||||
#### [Configure]()
|
||||
##### [Configure iOS features](microsoft-defender-atp/ios-configure-features.md)
|
||||
#### [Privacy](microsoft-defender-atp/ios-privacy.md)
|
||||
|
||||
|
||||
### [Microsoft Defender for Endpoint for Linux]()
|
||||
#### [Overview of Microsoft Defender for Endpoint for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md)
|
||||
#### [What's New](microsoft-defender-atp/linux-whatsnew.md)
|
||||
#### [Deploy]()
|
||||
##### [Manual deployment](microsoft-defender-atp/linux-install-manually.md)
|
||||
##### [Puppet based deployment](microsoft-defender-atp/linux-install-with-puppet.md)
|
||||
##### [Ansible based deployment](microsoft-defender-atp/linux-install-with-ansible.md)
|
||||
|
||||
#### [Update](microsoft-defender-atp/linux-updates.md)
|
||||
|
||||
|
||||
#### [Configure]()
|
||||
##### [Configure and validate exclusions](microsoft-defender-atp/linux-exclusions.md)
|
||||
##### [Static proxy configuration](microsoft-defender-atp/linux-static-proxy-configuration.md)
|
||||
##### [Set preferences](microsoft-defender-atp/linux-preferences.md)
|
||||
##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/linux-pua.md)
|
||||
##### [Schedule scans with Microsoft Defender for Endpoint for Linux](microsoft-defender-atp/linux-schedule-scan-atp.md)
|
||||
##### [Schedule an update of the Microsoft Defender for Endpoint (Linux)](microsoft-defender-atp/linux-update-MDE-Linux.md)
|
||||
|
||||
#### [Troubleshoot]()
|
||||
##### [Troubleshoot installation issues](microsoft-defender-atp/linux-support-install.md)
|
||||
##### [Troubleshoot cloud connectivity issues](microsoft-defender-atp/linux-support-connectivity.md)
|
||||
##### [Troubleshoot performance issues](microsoft-defender-atp/linux-support-perf.md)
|
||||
##### [Troubleshoot missing events issues](microsoft-defender-atp/linux-support-events.md)
|
||||
|
||||
|
||||
#### [Privacy](microsoft-defender-atp/linux-privacy.md)
|
||||
#### [Resources](microsoft-defender-atp/linux-resources.md)
|
||||
|
||||
|
||||
### [Microsoft Defender for Endpoint for Android]()
|
||||
#### [Overview of Microsoft Defender for Endpoint for Android](microsoft-defender-atp/microsoft-defender-atp-android.md)
|
||||
|
||||
#### [Deploy]()
|
||||
##### [Deploy Microsoft Defender for Endpoint for Android with Microsoft Intune](microsoft-defender-atp/android-intune.md)
|
||||
|
||||
#### [Configure]()
|
||||
##### [Configure Microsoft Defender for Endpoint for Android features](microsoft-defender-atp/android-configure.md)
|
||||
|
||||
#### [Privacy]()
|
||||
##### [Microsoft Defender for Endpoint for Android - Privacy information](microsoft-defender-atp/android-privacy.md)
|
||||
|
||||
#### [Troubleshoot]()
|
||||
##### [Troubleshoot issues](microsoft-defender-atp/android-support-signin.md)
|
||||
|
||||
|
||||
### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md)
|
||||
|
||||
## [Security operations]()
|
||||
|
||||
### [Endpoint detection and response]()
|
||||
#### [Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md)
|
||||
#### [Security operations dashboard](microsoft-defender-atp/security-operations-dashboard.md)
|
||||
#### [Incidents queue]()
|
||||
##### [View and organize the Incidents queue](microsoft-defender-atp/view-incidents-queue.md)
|
||||
##### [Manage incidents](microsoft-defender-atp/manage-incidents.md)
|
||||
##### [Investigate incidents](microsoft-defender-atp/investigate-incidents.md)
|
||||
|
||||
|
||||
#### [Alerts queue]()
|
||||
##### [View and organize the Alerts queue](microsoft-defender-atp/alerts-queue.md)
|
||||
##### [Review alerts](microsoft-defender-atp/review-alerts.md)
|
||||
##### [Manage alerts](microsoft-defender-atp/manage-alerts.md)
|
||||
##### [Investigate alerts](microsoft-defender-atp/investigate-alerts.md)
|
||||
##### [Investigate files](microsoft-defender-atp/investigate-files.md)
|
||||
##### [Investigate devices](microsoft-defender-atp/investigate-machines.md)
|
||||
##### [Investigate an IP address](microsoft-defender-atp/investigate-ip.md)
|
||||
##### [Investigate a domain](microsoft-defender-atp/investigate-domain.md)
|
||||
###### [Investigate connection events that occur behind forward proxies](microsoft-defender-atp/investigate-behind-proxy.md)
|
||||
##### [Investigate a user account](microsoft-defender-atp/investigate-user.md)
|
||||
|
||||
#### [Devices list]()
|
||||
##### [View and organize the Devices list](microsoft-defender-atp/machines-view-overview.md)
|
||||
##### [Device timeline event flags](microsoft-defender-atp/device-timeline-event-flag.md)
|
||||
##### [Manage device group and tags](microsoft-defender-atp/machine-tags.md)
|
||||
|
||||
#### [Take response actions]()
|
||||
##### [Take response actions on a device]()
|
||||
###### [Response actions on devices](microsoft-defender-atp/respond-machine-alerts.md)
|
||||
###### [Manage tags](microsoft-defender-atp/respond-machine-alerts.md#manage-tags)
|
||||
###### [Start an automated investigation](microsoft-defender-atp/respond-machine-alerts.md#initiate-automated-investigation)
|
||||
###### [Start a Live Response session](microsoft-defender-atp/respond-machine-alerts.md#initiate-live-response-session)
|
||||
###### [Collect investigation package](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-devices)
|
||||
###### [Run antivirus scan](microsoft-defender-atp/respond-machine-alerts.md#run-microsoft-defender-antivirus-scan-on-devices)
|
||||
###### [Restrict app execution](microsoft-defender-atp/respond-machine-alerts.md#restrict-app-execution)
|
||||
###### [Isolate devices from the network](microsoft-defender-atp/respond-machine-alerts.md#isolate-devices-from-the-network)
|
||||
###### [Consult a threat expert](microsoft-defender-atp/respond-machine-alerts.md#consult-a-threat-expert)
|
||||
###### [Check activity details in Action center](microsoft-defender-atp/respond-machine-alerts.md#check-activity-details-in-action-center)
|
||||
|
||||
##### [Take response actions on a file]()
|
||||
###### [Response actions on files](microsoft-defender-atp/respond-file-alerts.md)
|
||||
###### [Stop and quarantine files in your network](microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network)
|
||||
###### [Restore file from quarantine](microsoft-defender-atp/respond-file-alerts.md#restore-file-from-quarantine)
|
||||
###### [Add indicators to block or allow a file](microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file)
|
||||
###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file)
|
||||
###### [Consult a threat expert](microsoft-defender-atp/respond-file-alerts.md#consult-a-threat-expert)
|
||||
###### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center)
|
||||
###### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis)
|
||||
|
||||
#### [Visit the Action center to see remediation actions](microsoft-defender-atp/auto-investigation-action-center.md)
|
||||
##### [View and approve pending actions](microsoft-defender-atp/manage-auto-investigation.md)
|
||||
##### [Details and results of an automated investigation](microsoft-defender-atp/autoir-investigation-results.md)
|
||||
|
||||
#### [Investigate entities using Live response]()
|
||||
##### [Investigate entities on devices](microsoft-defender-atp/live-response.md)
|
||||
##### [Live response command examples](microsoft-defender-atp/live-response-command-examples.md)
|
||||
|
||||
|
||||
|
||||
#### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md)
|
||||
|
||||
#### [Reporting]()
|
||||
##### [Power BI - How to use API - Samples](microsoft-defender-atp/api-power-bi.md)
|
||||
##### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md)
|
||||
#### [Device health and compliance reports](microsoft-defender-atp/machine-reports.md)
|
||||
|
||||
### [Behavioral blocking and containment]()
|
||||
#### [Behavioral blocking and containment](microsoft-defender-atp/behavioral-blocking-containment.md)
|
||||
#### [Client behavioral blocking](microsoft-defender-atp/client-behavioral-blocking.md)
|
||||
#### [Feedback-loop blocking](microsoft-defender-atp/feedback-loop-blocking.md)
|
||||
#### [EDR in block mode](microsoft-defender-atp/edr-in-block-mode.md)
|
||||
|
||||
### [Automated investigation and response (AIR)]()
|
||||
#### [Overview of AIR](microsoft-defender-atp/automated-investigations.md)
|
||||
#### [Automation levels in AIR](microsoft-defender-atp/automation-levels.md)
|
||||
#### [Configure AIR capabilities](microsoft-defender-atp/configure-automated-investigations-remediation.md)
|
||||
|
||||
### [Advanced hunting]()
|
||||
#### [Advanced hunting overview](microsoft-defender-atp/advanced-hunting-overview.md)
|
||||
#### [Learn, train, & get examples]()
|
||||
##### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md)
|
||||
##### [Use shared queries](microsoft-defender-atp/advanced-hunting-shared-queries.md)
|
||||
#### [Work with query results](microsoft-defender-atp/advanced-hunting-query-results.md)
|
||||
#### [Optimize & handle errors]()
|
||||
##### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md)
|
||||
##### [Handle errors](microsoft-defender-atp/advanced-hunting-errors.md)
|
||||
##### [Service limits](microsoft-defender-atp/advanced-hunting-limits.md)
|
||||
#### [Data schema]()
|
||||
##### [Understand the schema](microsoft-defender-atp/advanced-hunting-schema-reference.md)
|
||||
##### [DeviceAlertEvents](microsoft-defender-atp/advanced-hunting-devicealertevents-table.md)
|
||||
##### [DeviceFileEvents](microsoft-defender-atp/advanced-hunting-devicefileevents-table.md)
|
||||
##### [DeviceImageLoadEvents](microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md)
|
||||
##### [DeviceLogonEvents](microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md)
|
||||
##### [DeviceInfo](microsoft-defender-atp/advanced-hunting-deviceinfo-table.md)
|
||||
##### [DeviceNetworkInfo](microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md)
|
||||
##### [DeviceEvents](microsoft-defender-atp/advanced-hunting-deviceevents-table.md)
|
||||
##### [DeviceFileCertificateInfo](microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table.md)
|
||||
##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md)
|
||||
##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md)
|
||||
##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md)
|
||||
##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md)
|
||||
##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md)
|
||||
#### [Custom detections]()
|
||||
##### [Custom detections overview](microsoft-defender-atp/overview-custom-detections.md)
|
||||
##### [Create detection rules](microsoft-defender-atp/custom-detection-rules.md)
|
||||
##### [View & manage detection rules](microsoft-defender-atp/custom-detections-manage.md)
|
||||
|
||||
### [Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md)
|
||||
|
||||
### [Threat analytics overview](microsoft-defender-atp/threat-analytics.md)
|
||||
#### [Read the analyst report](microsoft-defender-atp/threat-analytics-analyst-reports.md)
|
||||
|
||||
|
||||
## [How-to]()
|
||||
### [Onboard devices to the service]()
|
||||
#### [Onboard devices to Microsoft Defender for Endpoint](microsoft-defender-atp/onboard-configure.md)
|
||||
#### [Onboard previous versions of Windows](microsoft-defender-atp/onboard-downlevel.md)
|
||||
#### [Onboard Windows 10 devices]()
|
||||
##### [Onboarding tools and methods](microsoft-defender-atp/configure-endpoints.md)
|
||||
##### [Onboard devices using Group Policy](microsoft-defender-atp/configure-endpoints-gp.md)
|
||||
##### [Onboard devices using Microsoft Endpoint Configuration Manager](microsoft-defender-atp/configure-endpoints-sccm.md)
|
||||
##### [Onboard devices using Mobile Device Management tools](microsoft-defender-atp/configure-endpoints-mdm.md)
|
||||
##### [Onboard devices using a local script](microsoft-defender-atp/configure-endpoints-script.md)
|
||||
##### [Onboard non-persistent virtual desktop infrastructure (VDI) devices](microsoft-defender-atp/configure-endpoints-vdi.md)
|
||||
##### [Onboard Windows 10 multi-session devices in Windows Virtual Desktop](microsoft-defender-atp/Onboard-Windows-10-multi-session-device.md)
|
||||
|
||||
#### [Onboard Windows servers](microsoft-defender-atp/configure-server-endpoints.md)
|
||||
#### [Onboard non-Windows devices](microsoft-defender-atp/configure-endpoints-non-windows.md)
|
||||
#### [Onboard devices without Internet access](microsoft-defender-atp/onboard-offline-machines.md)
|
||||
#### [Run a detection test on a newly onboarded device](microsoft-defender-atp/run-detection-test.md)
|
||||
#### [Run simulated attacks on devices](microsoft-defender-atp/attack-simulations.md)
|
||||
#### [Configure proxy and Internet connectivity settings](microsoft-defender-atp/configure-proxy-internet.md)
|
||||
#### [Create an onboarding or offboarding notification rule](microsoft-defender-atp/onboarding-notification.md)
|
||||
|
||||
#### [Troubleshoot onboarding issues]()
|
||||
##### [Troubleshoot issues during onboarding](microsoft-defender-atp/troubleshoot-onboarding.md)
|
||||
##### [Troubleshoot subscription and portal access issues](microsoft-defender-atp/troubleshoot-onboarding-error-messages.md)
|
||||
|
||||
### [Manage device configuration]()
|
||||
#### [Ensure your devices are configured properly](microsoft-defender-atp/configure-machines.md)
|
||||
#### [Monitor and increase device onboarding](microsoft-defender-atp/configure-machines-onboarding.md)
|
||||
#### [Increase compliance to the security baseline](microsoft-defender-atp/configure-machines-security-baseline.md)
|
||||
#### [Optimize attack surface reduction rule deployment and detections](microsoft-defender-atp/configure-machines-asr.md)
|
||||
|
||||
### [Configure portal settings]()
|
||||
#### [Set up preferences](microsoft-defender-atp/preferences-setup.md)
|
||||
#### [General]()
|
||||
##### [Verify data storage location and update data retention settings](microsoft-defender-atp/data-retention-settings.md)
|
||||
##### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md)
|
||||
##### [Configure vulnerability notifications](microsoft-defender-atp/configure-vulnerability-email-notifications.md)
|
||||
##### [Configure advanced features](microsoft-defender-atp/advanced-features.md)
|
||||
|
||||
#### [Permissions]()
|
||||
##### [Use basic permissions to access the portal](microsoft-defender-atp/basic-permissions.md)
|
||||
##### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md)
|
||||
###### [Create and manage roles](microsoft-defender-atp/user-roles.md)
|
||||
###### [Create and manage device groups](microsoft-defender-atp/machine-groups.md)
|
||||
###### [Create and manage device tags](microsoft-defender-atp/machine-tags.md)
|
||||
|
||||
|
||||
#### [Rules]()
|
||||
##### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md)
|
||||
##### [Create indicators](microsoft-defender-atp/manage-indicators.md)
|
||||
###### [Create indicators for files](microsoft-defender-atp/indicator-file.md)
|
||||
###### [Create indicators for IPs and URLs/domains](microsoft-defender-atp/indicator-ip-domain.md)
|
||||
###### [Create indicators for certificates](microsoft-defender-atp/indicator-certificates.md)
|
||||
###### [Manage indicators](microsoft-defender-atp/indicator-manage.md)
|
||||
##### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md)
|
||||
##### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md)
|
||||
|
||||
#### [Device management]()
|
||||
##### [Onboarding devices](microsoft-defender-atp/onboard-configure.md)
|
||||
##### [Offboarding devices](microsoft-defender-atp/offboard-machines.md)
|
||||
|
||||
#### [Configure Microsoft Defender Security Center time zone settings](microsoft-defender-atp/time-settings.md)
|
||||
|
||||
### [Configure integration with other Microsoft solutions]()
|
||||
#### [Configure conditional access](microsoft-defender-atp/configure-conditional-access.md)
|
||||
#### [Configure Microsoft Cloud App Security integration](microsoft-defender-atp/microsoft-cloud-app-security-config.md)
|
||||
|
||||
### [Address false positives/negatives in Microsoft Defender for Endpoint](microsoft-defender-atp/defender-endpoint-false-positives-negatives.md)
|
||||
|
||||
### [Use audit mode](microsoft-defender-atp/audit-windows-defender.md)
|
||||
|
||||
## Reference
|
||||
### [Management and APIs]()
|
||||
#### [Overview of management and APIs](microsoft-defender-atp/management-apis.md)
|
||||
#### [Microsoft Defender for Endpoint API]()
|
||||
##### [Get started]()
|
||||
###### [Microsoft Defender for Endpoint API license and terms](microsoft-defender-atp/api-terms-of-use.md)
|
||||
###### [Access the Microsoft Defender for Endpoint APIs](microsoft-defender-atp/apis-intro.md)
|
||||
###### [Hello World](microsoft-defender-atp/api-hello-world.md)
|
||||
###### [Get access with application context](microsoft-defender-atp/exposed-apis-create-app-webapp.md)
|
||||
###### [Get access with user context](microsoft-defender-atp/exposed-apis-create-app-nativeapp.md)
|
||||
###### [Get partner application access](microsoft-defender-atp/exposed-apis-create-app-partners.md)
|
||||
|
||||
##### [Microsoft Defender for Endpoint APIs Schema]()
|
||||
###### [Supported Microsoft Defender for Endpoint APIs](microsoft-defender-atp/exposed-apis-list.md)
|
||||
###### [Release Notes](microsoft-defender-atp/api-release-notes.md)
|
||||
###### [Common REST API error codes](microsoft-defender-atp/common-errors.md)
|
||||
###### [Advanced Hunting](microsoft-defender-atp/run-advanced-query-api.md)
|
||||
|
||||
###### [Alert]()
|
||||
####### [Alert methods and properties](microsoft-defender-atp/alerts.md)
|
||||
####### [List alerts](microsoft-defender-atp/get-alerts.md)
|
||||
####### [Create alert](microsoft-defender-atp/create-alert-by-reference.md)
|
||||
####### [Update alert](microsoft-defender-atp/update-alert.md)
|
||||
####### [Batch update alert](microsoft-defender-atp/batch-update-alerts.md)
|
||||
####### [Get alert information by ID](microsoft-defender-atp/get-alert-info-by-id.md)
|
||||
####### [Get alert related domains information](microsoft-defender-atp/get-alert-related-domain-info.md)
|
||||
####### [Get alert related file information](microsoft-defender-atp/get-alert-related-files-info.md)
|
||||
####### [Get alert related IPs information](microsoft-defender-atp/get-alert-related-ip-info.md)
|
||||
####### [Get alert related device information](microsoft-defender-atp/get-alert-related-machine-info.md)
|
||||
####### [Get alert related user information](microsoft-defender-atp/get-alert-related-user-info.md)
|
||||
|
||||
###### [Machine]()
|
||||
####### [Machine methods and properties](microsoft-defender-atp/machine.md)
|
||||
####### [List machines](microsoft-defender-atp/get-machines.md)
|
||||
####### [Get machine by ID](microsoft-defender-atp/get-machine-by-id.md)
|
||||
####### [Get machine log on users](microsoft-defender-atp/get-machine-log-on-users.md)
|
||||
####### [Get machine related alerts](microsoft-defender-atp/get-machine-related-alerts.md)
|
||||
####### [Get installed software](microsoft-defender-atp/get-installed-software.md)
|
||||
####### [Get discovered vulnerabilities](microsoft-defender-atp/get-discovered-vulnerabilities.md)
|
||||
####### [Get security recommendations](microsoft-defender-atp/get-security-recommendations.md)
|
||||
####### [Add or Remove machine tags](microsoft-defender-atp/add-or-remove-machine-tags.md)
|
||||
####### [Find machines by IP](microsoft-defender-atp/find-machines-by-ip.md)
|
||||
####### [Find machines by tag](microsoft-defender-atp/find-machines-by-tag.md)
|
||||
####### [Get missing KBs](microsoft-defender-atp/get-missing-kbs-machine.md)
|
||||
####### [Set device value](microsoft-defender-atp/set-device-value.md)
|
||||
|
||||
###### [Machine Action]()
|
||||
####### [Machine Action methods and properties](microsoft-defender-atp/machineaction.md)
|
||||
####### [List Machine Actions](microsoft-defender-atp/get-machineactions-collection.md)
|
||||
####### [Get Machine Action](microsoft-defender-atp/get-machineaction-object.md)
|
||||
####### [Collect investigation package](microsoft-defender-atp/collect-investigation-package.md)
|
||||
####### [Get investigation package SAS URI](microsoft-defender-atp/get-package-sas-uri.md)
|
||||
####### [Isolate machine](microsoft-defender-atp/isolate-machine.md)
|
||||
####### [Release machine from isolation](microsoft-defender-atp/unisolate-machine.md)
|
||||
####### [Restrict app execution](microsoft-defender-atp/restrict-code-execution.md)
|
||||
####### [Remove app restriction](microsoft-defender-atp/unrestrict-code-execution.md)
|
||||
####### [Run antivirus scan](microsoft-defender-atp/run-av-scan.md)
|
||||
####### [Offboard machine](microsoft-defender-atp/offboard-machine-api.md)
|
||||
####### [Stop and quarantine file](microsoft-defender-atp/stop-and-quarantine-file.md)
|
||||
|
||||
###### [Automated Investigation]()
|
||||
####### [Investigation methods and properties](microsoft-defender-atp/investigation.md)
|
||||
####### [List Investigation](microsoft-defender-atp/get-investigation-collection.md)
|
||||
####### [Get Investigation](microsoft-defender-atp/get-investigation-object.md)
|
||||
####### [Start Investigation](microsoft-defender-atp/initiate-autoir-investigation.md)
|
||||
|
||||
###### [Indicators]()
|
||||
####### [Indicators methods and properties](microsoft-defender-atp/ti-indicator.md)
|
||||
####### [Submit Indicator](microsoft-defender-atp/post-ti-indicator.md)
|
||||
####### [Import Indicators](microsoft-defender-atp/import-ti-indicators.md)
|
||||
####### [List Indicators](microsoft-defender-atp/get-ti-indicators-collection.md)
|
||||
####### [Delete Indicator](microsoft-defender-atp/delete-ti-indicator-by-id.md)
|
||||
|
||||
###### [Domain]()
|
||||
####### [Get domain related alerts](microsoft-defender-atp/get-domain-related-alerts.md)
|
||||
####### [Get domain related machines](microsoft-defender-atp/get-domain-related-machines.md)
|
||||
####### [Get domain statistics](microsoft-defender-atp/get-domain-statistics.md)
|
||||
|
||||
###### [File]()
|
||||
####### [File methods and properties](microsoft-defender-atp/files.md)
|
||||
####### [Get file information](microsoft-defender-atp/get-file-information.md)
|
||||
####### [Get file related alerts](microsoft-defender-atp/get-file-related-alerts.md)
|
||||
####### [Get file related machines](microsoft-defender-atp/get-file-related-machines.md)
|
||||
####### [Get file statistics](microsoft-defender-atp/get-file-statistics.md)
|
||||
|
||||
###### [IP]()
|
||||
####### [Get IP related alerts](microsoft-defender-atp/get-ip-related-alerts.md)
|
||||
####### [Get IP statistics](microsoft-defender-atp/get-ip-statistics.md)
|
||||
|
||||
###### [User]()
|
||||
####### [User methods](microsoft-defender-atp/user.md)
|
||||
####### [Get user related alerts](microsoft-defender-atp/get-user-related-alerts.md)
|
||||
####### [Get user related machines](microsoft-defender-atp/get-user-related-machines.md)
|
||||
|
||||
###### [Score]()
|
||||
####### [Score methods and properties](microsoft-defender-atp/score.md)
|
||||
####### [List exposure score by machine group](microsoft-defender-atp/get-machine-group-exposure-score.md)
|
||||
####### [Get exposure score](microsoft-defender-atp/get-exposure-score.md)
|
||||
####### [Get device secure score](microsoft-defender-atp/get-device-secure-score.md)
|
||||
|
||||
###### [Software]()
|
||||
####### [Software methods and properties](microsoft-defender-atp/software.md)
|
||||
####### [List software](microsoft-defender-atp/get-software.md)
|
||||
####### [Get software by Id](microsoft-defender-atp/get-software-by-id.md)
|
||||
####### [List software version distribution](microsoft-defender-atp/get-software-ver-distribution.md)
|
||||
####### [List machines by software](microsoft-defender-atp/get-machines-by-software.md)
|
||||
####### [List vulnerabilities by software](microsoft-defender-atp/get-vuln-by-software.md)
|
||||
####### [Get missing KBs](microsoft-defender-atp/get-missing-kbs-software.md)
|
||||
|
||||
###### [Vulnerability]()
|
||||
####### [Vulnerability methods and properties](microsoft-defender-atp/vulnerability.md)
|
||||
####### [List vulnerabilities](microsoft-defender-atp/get-all-vulnerabilities.md)
|
||||
####### [List vulnerabilities by machine and software](microsoft-defender-atp/get-all-vulnerabilities-by-machines.md)
|
||||
####### [Get vulnerability by Id](microsoft-defender-atp/get-vulnerability-by-id.md)
|
||||
####### [List machines by vulnerability](microsoft-defender-atp/get-machines-by-vulnerability.md)
|
||||
|
||||
###### [Recommendation]()
|
||||
####### [Recommendation methods and properties](microsoft-defender-atp/recommendation.md)
|
||||
####### [List all recommendations](microsoft-defender-atp/get-all-recommendations.md)
|
||||
####### [Get recommendation by Id](microsoft-defender-atp/get-recommendation-by-id.md)
|
||||
####### [Get recommendation by software](microsoft-defender-atp/get-recommendation-software.md)
|
||||
####### [List machines by recommendation](microsoft-defender-atp/get-recommendation-machines.md)
|
||||
####### [List vulnerabilities by recommendation](microsoft-defender-atp/get-recommendation-vulnerabilities.md)
|
||||
|
||||
##### [How to use APIs - Samples]()
|
||||
###### [Microsoft Flow](microsoft-defender-atp/api-microsoft-flow.md)
|
||||
###### [Power BI](microsoft-defender-atp/api-power-bi.md)
|
||||
###### [Advanced Hunting using Python](microsoft-defender-atp/run-advanced-query-sample-python.md)
|
||||
###### [Advanced Hunting using PowerShell](microsoft-defender-atp/run-advanced-query-sample-powershell.md)
|
||||
###### [Using OData Queries](microsoft-defender-atp/exposed-apis-odata-samples.md)
|
||||
|
||||
#### [Raw data streaming API]()
|
||||
##### [Raw data streaming](microsoft-defender-atp/raw-data-export.md)
|
||||
##### [Stream advanced hunting events to Azure Events hub](microsoft-defender-atp/raw-data-export-event-hub.md)
|
||||
##### [Stream advanced hunting events to your storage account](microsoft-defender-atp/raw-data-export-storage.md)
|
||||
|
||||
#### [SIEM integration]()
|
||||
##### [Understand threat intelligence concepts](microsoft-defender-atp/threat-indicator-concepts.md)
|
||||
##### [Learn about different ways to pull detections](microsoft-defender-atp/configure-siem.md)
|
||||
##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md)
|
||||
##### [Configure Micro Focus ArcSight to pull detections](microsoft-defender-atp/configure-arcsight.md)
|
||||
##### [Microsoft Defender for Endpoint detection fields](microsoft-defender-atp/api-portal-mapping.md)
|
||||
##### [Pull detections using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md)
|
||||
##### [Fetch alerts from customer tenant](microsoft-defender-atp/fetch-alerts-mssp.md)
|
||||
##### [Troubleshoot SIEM tool integration issues](microsoft-defender-atp/troubleshoot-siem.md)
|
||||
|
||||
#### [Partners & APIs]()
|
||||
##### [Partner applications](microsoft-defender-atp/partner-applications.md)
|
||||
##### [Connected applications](microsoft-defender-atp/connected-applications.md)
|
||||
##### [API explorer](microsoft-defender-atp/api-explorer.md)
|
||||
|
||||
#### [Role-based access control]()
|
||||
##### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md)
|
||||
##### [Create and manage roles](microsoft-defender-atp/user-roles.md)
|
||||
##### [Create and manage device groups]()
|
||||
###### [Using device groups](microsoft-defender-atp/machine-groups.md)
|
||||
###### [Create and manage device tags](microsoft-defender-atp/machine-tags.md)
|
||||
|
||||
#### [Managed security service provider (MSSP) integration]()
|
||||
##### [Configure managed security service provider integration](microsoft-defender-atp/configure-mssp-support.md)
|
||||
##### [Supported managed security service providers](microsoft-defender-atp/mssp-list.md)
|
||||
##### [Grant MSSP access to the portal](microsoft-defender-atp/grant-mssp-access.md)
|
||||
##### [Access the MSSP customer portal](microsoft-defender-atp/access-mssp-portal.md)
|
||||
##### [Configure alert notifications](microsoft-defender-atp/configure-mssp-notifications.md)
|
||||
##### [Get partner application access](microsoft-defender-atp/exposed-apis-create-app-partners.md)
|
||||
|
||||
### [Partner integration scenarios]()
|
||||
#### [Technical partner opportunities](microsoft-defender-atp/partner-integration.md)
|
||||
#### [Managed security service provider opportunity](microsoft-defender-atp/mssp-support.md)
|
||||
#### [Become a Microsoft Defender for Endpoint partner](microsoft-defender-atp/get-started-partner-integration.md)
|
||||
|
||||
|
||||
### [Integrations]()
|
||||
#### [Microsoft Defender for Endpoint integrations](microsoft-defender-atp/threat-protection-integration.md)
|
||||
#### [Protect users, data, and devices with conditional access](microsoft-defender-atp/conditional-access.md)
|
||||
#### [Microsoft Cloud App Security integration overview](microsoft-defender-atp/microsoft-cloud-app-security-integration.md)
|
||||
|
||||
|
||||
### [Information protection in Windows overview]()
|
||||
#### [Windows integration](microsoft-defender-atp/information-protection-in-windows-overview.md)
|
||||
|
||||
### [Access the Microsoft Defender for Endpoint Community Center](microsoft-defender-atp/community.md)
|
||||
|
||||
### [Helpful resources](microsoft-defender-atp/helpful-resources.md)
|
||||
|
||||
|
||||
|
||||
### [Troubleshoot Microsoft Defender for Endpoint]()
|
||||
#### [Troubleshoot sensor state]()
|
||||
##### [Check sensor state](microsoft-defender-atp/check-sensor-status.md)
|
||||
##### [Fix unhealthy sensors](microsoft-defender-atp/fix-unhealthy-sensors.md)
|
||||
##### [Inactive devices](microsoft-defender-atp/fix-unhealthy-sensors.md#inactive-devices)
|
||||
##### [Misconfigured devices](microsoft-defender-atp/fix-unhealthy-sensors.md#misconfigured-devices)
|
||||
##### [Review sensor events and errors on machines with Event Viewer](microsoft-defender-atp/event-error-codes.md)
|
||||
|
||||
#### [Troubleshoot Microsoft Defender for Endpoint service issues]()
|
||||
##### [Troubleshoot service issues](microsoft-defender-atp/troubleshoot-mdatp.md)
|
||||
##### [Check service health](microsoft-defender-atp/service-status.md)
|
||||
##### [Contact Microsoft Defender for Endpoint support](microsoft-defender-atp/contact-support.md)
|
||||
|
||||
|
||||
#### [Troubleshoot live response issues](microsoft-defender-atp/troubleshoot-live-response.md)
|
||||
|
||||
#### [Collect support logs using LiveAnalyzer ](microsoft-defender-atp/troubleshoot-collect-support-log.md)
|
||||
|
||||
#### [Troubleshoot attack surface reduction issues]()
|
||||
##### [Network protection](microsoft-defender-atp/troubleshoot-np.md)
|
||||
##### [Attack surface reduction rules](microsoft-defender-atp/troubleshoot-asr.md)
|
||||
|
||||
#### [Troubleshoot next-generation protection](microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md)
|
||||
#### [Troubleshoot migration issues](microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus-when-migrating.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## [Security intelligence](intelligence/index.md)
|
||||
### [Understand malware & other threats](intelligence/understanding-malware.md)
|
||||
#### [Prevent malware infection](intelligence/prevent-malware-infection.md)
|
||||
|
||||
@ -172,7 +172,7 @@ Microsoft uses specific categories and the category definitions to classify soft
|
||||
|
||||
* **Advertising software:** Software that displays advertisements or promotions, or prompts you to complete surveys for other products or services in software other than itself. This includes software that inserts advertisements to webpages.
|
||||
|
||||
* **Torrent software:** Software that is used to create or download torrents or other files specifically used with peer-to-peer file-sharing technologies.
|
||||
* **Torrent software (Enterprise only):** Software that is used to create or download torrents or other files specifically used with peer-to-peer file-sharing technologies.
|
||||
|
||||
* **Cryptomining software:** Software that uses your device resources to mine cryptocurrencies.
|
||||
|
||||
|
||||
@ -31,6 +31,8 @@ ms.technology: mde
|
||||
|
||||
You can exclude certain files from Microsoft Defender Antivirus scans by modifying exclusion lists. **Generally, you shouldn't need to apply exclusions**. Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.
|
||||
|
||||
**Note**: Exclusions apply to Potentially Unwanted Apps (PUA) detections as well.
|
||||
|
||||
> [!NOTE]
|
||||
> Automatic exclusions apply only to Windows Server 2016 and above. These exclusions are not visible in the Windows Security app and in PowerShell.
|
||||
|
||||
|
||||
@ -151,7 +151,7 @@ Setting the value for this cmdlet to `Disabled` turns the feature off if it has
|
||||
|
||||
See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus.
|
||||
|
||||
### View PUA events
|
||||
## View PUA events
|
||||
|
||||
PUA events are reported in the Windows Event Viewer, but not in Microsoft Endpoint Manager or in Intune. You can also use the `Get-MpThreat` cmdlet to view threats that Microsoft Defender Antivirus handled. Here's an example:
|
||||
|
||||
@ -174,11 +174,11 @@ You can turn on email notifications to receive mail about PUA detections.
|
||||
|
||||
See [Troubleshoot event IDs](troubleshoot-microsoft-defender-antivirus.md) for details on viewing Microsoft Defender Antivirus events. PUA events are recorded under event ID **1160**.
|
||||
|
||||
### Allow-listing apps
|
||||
## Excluding files
|
||||
|
||||
Sometimes a file is erroneously blocked by PUA protection, or a feature of a PUA is required to complete a task. In these cases, a file can be allow-listed.
|
||||
Sometimes a file is erroneously blocked by PUA protection, or a feature of a PUA is required to complete a task. In these cases, a file can be added to an exclusion list.
|
||||
|
||||
For more information, see [Recommended antivirus exclusions for Configuration Manager site servers, site systems, and clients](https://docs.microsoft.com/troubleshoot/mem/configmgr/recommended-antivirus-exclusions#exclusions).
|
||||
For more information, see [Configure and validate exclusions based on file extension and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md).
|
||||
|
||||
## See also
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 90 KiB |
@ -13,7 +13,7 @@ ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.reviewer: pahuijbr
|
||||
manager: dansimp
|
||||
ms.date: 02/04/2021
|
||||
ms.date: 02/12/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
@ -78,11 +78,11 @@ All our updates contain
|
||||
<br/><br/>
|
||||
|
||||
<details>
|
||||
<summary> January-2021 (Platform: 4.18.2101.8 | Engine: 1.1.17800.5)</summary>
|
||||
<summary> January-2021 (Platform: 4.18.2101.9 | Engine: 1.1.17800.5)</summary>
|
||||
|
||||
 Security intelligence update version: **1.327.1854.0**
|
||||
 Released: **February 2, 2021**
|
||||
 Platform: **4.18.2101.8**
|
||||
 Platform: **4.18.2101.9**
|
||||
 Engine: **1.1.17800.5**
|
||||
 Support phase: **Security and Critical Updates**
|
||||
|
||||
@ -93,6 +93,7 @@ All our updates contain
|
||||
- Increased visibility for credential stealing attempts
|
||||
- Improvements in antitampering features in Microsoft Defender Antivirus services
|
||||
- Improved support for ARM x64 emulation
|
||||
- Fix: EDR Block notification remains in threat history after real-time protection performed initial detection
|
||||
|
||||
### Known Issues
|
||||
No known issues
|
||||
@ -146,7 +147,7 @@ After a new package version is released, support for the previous two versions i
|
||||
 Released: **October 01, 2020**
|
||||
 Platform: **4.18.2009.7**
|
||||
 Engine: **1.1.17500.4**
|
||||
 Support phase: **Security and Critical Updates**
|
||||
 Support phase: **Technical upgrade support (only)**
|
||||
|
||||
### What's new
|
||||
|
||||
@ -172,7 +173,8 @@ No known issues
|
||||
 Released: **August 27, 2020**
|
||||
 Platform: **4.18.2008.9**
|
||||
 Engine: **1.1.17400.5**
|
||||
|
||||
 Support phase: **Technical upgrade support (only)**
|
||||
|
||||
### What's new
|
||||
|
||||
- Add more telemetry events
|
||||
|
||||
@ -110,7 +110,7 @@ The table in this section summarizes the functionality and features that are ava
|
||||
|
||||
- When Microsoft Defender Antivirus is disabled automatically, it can be re-enabled automatically if the protection offered by a non-Microsoft antivirus product expires or otherwise stops providing real-time protection from viruses, malware, or other threats. Automatic re-enabling helps to ensure that antivirus protection is maintained on your devices. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), which uses the Microsoft Defender Antivirus engine to periodically check for threats in addition to your main antivirus app.
|
||||
|
||||
- When Microsoft Defender Antivirus is in passive mode, you can still [manage updates for Microsoft Defender Antivirus](manage-updates-baselines-microsoft-defender-antivirus.md); however, you can't move Microsoft Defender Antivirus into active mode if your devices have an up-to-date, non-Microsoft antivirus product providing real-time protection from malware.
|
||||
- When Microsoft Defender Antivirus is in passive mode, you can still [manage updates for Microsoft Defender Antivirus](manage-updates-baselines-microsoft-defender-antivirus.md); however, you can't move Microsoft Defender Antivirus into active mode if your devices have an up-to-date, non-Microsoft antivirus product providing real-time protection from malware. For optimal security layered defense and detection efficacy, please ensure that you update the [Microsoft Defender Antivirus protection (Security intelligence update, Engine and Platform)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus) even if Microsoft Defender Antivirus is running in passive mode.
|
||||
|
||||
If you uninstall the non-Microsoft antivirus product, and use Microsoft Defender Antivirus to provide protection to your devices, Microsoft Defender Antivirus will return to its normal active mode automatically.
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ audience: ITPro
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 01/07/2021
|
||||
ms.date: 02/17/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
@ -27,10 +27,12 @@ ms.technology: mde
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
Tamper protection is available on devices running the following versions of Windows:
|
||||
|
||||
Tamper protection is available for devices that are running one of the following versions of Windows:
|
||||
|
||||
- Windows 10
|
||||
- Windows Server 2016 and 2019 (if using tenant attach with [Configuration Manager, version 2006](#manage-tamper-protection-with-configuration-manager-version-2006))
|
||||
- Windows Server 2019
|
||||
- Windows Server, version 1803 or later
|
||||
- Windows Server 2016
|
||||
|
||||
## Overview
|
||||
|
||||
@ -49,76 +51,67 @@ With tamper protection, malicious apps are prevented from taking actions such as
|
||||
|
||||
Tamper protection essentially locks Microsoft Defender Antivirus and prevents your security settings from being changed through apps and methods such as:
|
||||
|
||||
- Configuring settings in Registry Editor on your Windows machine
|
||||
- Configuring settings in Registry Editor on your Windows device
|
||||
- Changing settings through PowerShell cmdlets
|
||||
- Editing or removing security settings through group policies
|
||||
|
||||
Tamper protection doesn't prevent you from viewing your security settings. And, tamper protection doesn't affect how third-party antivirus apps register with the Windows Security app. If your organization is using Windows 10 Enterprise E5, individual users can't change the tamper protection setting; tamper protection is managed by your security team.
|
||||
Tamper protection doesn't prevent you from viewing your security settings. And, tamper protection doesn't affect how third-party antivirus apps register with the Windows Security app. If your organization is using Windows 10 Enterprise E5, individual users can't change the tamper protection setting; in those cases, tamper protection is managed by your security team.
|
||||
|
||||
### What do you want to do?
|
||||
|
||||
1. Turn tamper protection on <br/>
|
||||
- [For an individual machine, use Windows Security](#turn-tamper-protection-on-or-off-for-an-individual-machine).
|
||||
- [For your organization, use Intune](#turn-tamper-protection-on-or-off-for-your-organization-using-intune).
|
||||
- [Use tenant attach with Configuration Manager, version 2006, for devices running Windows 10 or Windows Server 2019](#manage-tamper-protection-with-configuration-manager-version-2006)
|
||||
| To perform this task... | See this section... |
|
||||
|:---|:---|
|
||||
| Turn tamper protection on (or off) for an individual device | [Manage tamper protection on an individual device](#manage-tamper-protection-on-an-individual-device) |
|
||||
| Turn tamper protection on (or off) for all or part of your organization using Intune <p>Fine-tune tamper protection settings in your organization | [Manage tamper protection for your organization using Intune](#manage-tamper-protection-for-your-organization-using-intune) |
|
||||
| Turn tamper protection on (or off) for your organization with Configuration Manager | [Manage tamper protection for your organization using tenant attach with Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006) |
|
||||
| Turn tamper protection on (or off) in the Microsoft Defender Security Center <p>Manage tamper protection across your tenant <p>(Currently in preview) | [Manage tamper protection for your organization using the Microsoft Defender Security Center](#manage-tamper-protection-for-your-organization-using-the-microsoft-defender-security-center) |
|
||||
| View details about tampering attempts on devices | [View information about tampering attempts](#view-information-about-tampering-attempts) |
|
||||
| Review your security recommendations | [Review security recommendations](#review-your-security-recommendations) |
|
||||
| Review the list of frequently asked questions (FAQs) | [Browse the FAQs](#view-information-about-tampering-attempts) |
|
||||
|
||||
2. [View information about tampering attempts](#view-information-about-tampering-attempts).
|
||||
|
||||
3. [Review your security recommendations](#review-your-security-recommendations).
|
||||
|
||||
4. [Browse the frequently asked questions](#view-information-about-tampering-attempts).
|
||||
|
||||
## Turn tamper protection on (or off) for an individual machine
|
||||
## Manage tamper protection on an individual device
|
||||
|
||||
> [!NOTE]
|
||||
> Tamper protection blocks attempts to modify Microsoft Defender Antivirus settings through the registry.
|
||||
>
|
||||
> To help ensure that tamper protection doesn’t interfere with third-party security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. (See [Security intelligence updates](https://www.microsoft.com/wdsi/definitions).)
|
||||
>
|
||||
> Once you’ve made this update, tamper protection will continue to protect your registry settings, and will also log attempts to modify them without returning errors.
|
||||
> Once you’ve made this update, tamper protection continues to protect your registry settings, and logs attempts to modify them without returning errors.
|
||||
|
||||
If you are a home user, or you are not subject to settings managed by a security team, you can use the Windows Security app to turn tamper protection on or off. You must have appropriate admin permissions on your machine to do change security settings, such as tamper protection.
|
||||
If you are a home user, or you are not subject to settings managed by a security team, you can use the Windows Security app to manage tamper protection. You must have appropriate admin permissions on your device to do change security settings, such as tamper protection.
|
||||
|
||||
1. Click **Start**, and start typing *Security*. In the search results, select **Windows Security**.
|
||||
Here's what you see in the Windows Security app:
|
||||
|
||||
|
||||
|
||||
1. Select **Start**, and start typing *Security*. In the search results, select **Windows Security**.
|
||||
2. Select **Virus & threat protection** > **Virus & threat protection settings**.
|
||||
|
||||
3. Set **Tamper Protection** to **On** or **Off**.
|
||||
|
||||
Here's what you see in the Windows Security app:
|
||||
## Manage tamper protection for your organization using Intune
|
||||
|
||||
|
||||
If you are part of your organization's security team, and your subscription includes [Intune](https://docs.microsoft.com/intune/fundamentals/what-is-intune), you can turn tamper protection on (or off) for your organization in the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) portal. Use Intune when you want to fine-tune tamper protection settings. For example, if you want to enable tamper protection on some devices, but not all, use Intune.
|
||||
|
||||
## Turn tamper protection on (or off) for your organization using Intune
|
||||
### Requirements for managing tamper protection in Intune
|
||||
|
||||
If you are part of your organization's security team, and your subscription includes [Intune](https://docs.microsoft.com/intune/fundamentals/what-is-intune), you can turn tamper protection on (or off) for your organization in the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) portal.
|
||||
- You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations.
|
||||
- Your organization uses [Intune to manage devices](https://docs.microsoft.com/intune/fundamentals/what-is-device-management). ([Intune licenses](https://docs.microsoft.com/intune/fundamentals/licenses) are required; Intune is included in Microsoft 365 E5.)
|
||||
- Your Windows devices must be running Windows 10 OS [1709](https://docs.microsoft.com/windows/release-health/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-health/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-health/status-windows-10-1809-and-windows-server-2019) or later. (For more information about releases, see [Windows 10 release information](https://docs.microsoft.com/windows/release-health/release-information).)
|
||||
- You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above).
|
||||
- Your devices must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).)
|
||||
|
||||
You must have appropriate [permissions](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/assign-portal-access), such as global admin, security admin, or security operations, to perform the following task.
|
||||
### Turn tamper protection on (or off) in Intune
|
||||
|
||||
1. Make sure your organization meets all of the following requirements to use Intune to manage tamper protection:
|
||||
|
||||
- Your organization uses [Intune to manage devices](https://docs.microsoft.com/intune/fundamentals/what-is-device-management). ([Intune licenses](https://docs.microsoft.com/intune/fundamentals/licenses) are required; Intune is included in Microsoft 365 E5.)
|
||||
- Your Windows machines must be running Windows 10 OS [1709](https://docs.microsoft.com/windows/release-health/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-health/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-health/status-windows-10-1809-and-windows-server-2019) or later. (For more information about releases, see [Windows 10 release information](https://docs.microsoft.com/windows/release-health/release-information).)
|
||||
- You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above).
|
||||
- Your machines must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).)
|
||||
|
||||
2. Go to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) and sign in with your work or school account.
|
||||
|
||||
3. Select **Devices** > **Configuration Profiles**.
|
||||
|
||||
4. Create a profile that includes the following settings:
|
||||
|
||||
|
||||
1. Go to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) and sign in with your work or school account.
|
||||
2. Select **Devices** > **Configuration Profiles**.
|
||||
3. Create a profile that includes the following settings:
|
||||
- **Platform: Windows 10 and later**
|
||||
|
||||
- **Profile type: Endpoint protection**
|
||||
|
||||
- **Category: Microsoft Defender Security Center**
|
||||
|
||||
- **Tamper Protection: Enabled**
|
||||
|
||||
|
||||
|
||||
5. Assign the profile to one or more groups.
|
||||
4. Assign the profile to one or more groups.
|
||||
|
||||
### Are you using Windows OS 1709, 1803, or 1809?
|
||||
|
||||
@ -127,38 +120,60 @@ If you are using Windows 10 OS [1709](https://docs.microsoft.com/windows/release
|
||||
#### Use PowerShell to determine whether tamper protection is turned on
|
||||
|
||||
1. Open the Windows PowerShell app.
|
||||
|
||||
2. Use the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) PowerShell cmdlet.
|
||||
|
||||
3. In the list of results, look for `IsTamperProtected`. (A value of *true* means tamper protection is enabled.)
|
||||
|
||||
## Manage tamper protection with Configuration Manager, version 2006
|
||||
## Manage tamper protection for your organization with Configuration Manager, version 2006
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The procedure can be used to extend tamper protection to devices running Windows 10 and Windows Server 2019. Make sure to review the prerequisites and other information in the resources mentioned in this procedure.
|
||||
|
||||
If you're using [version 2006 of Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/plan-design/changes/whats-new-in-version-2006), you can manage tamper protection settings on Windows 10, Windows Server 2016, and Windows Server 2019 by using a method called *tenant attach*. Tenant attach enables you to sync your on-premises-only Configuration Manager devices into the Microsoft Endpoint Manager admin center, and then deliver your endpoint security configuration policies to your on-premises collections & devices.
|
||||
If you're using [version 2006 of Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/plan-design/changes/whats-new-in-version-2006), you can manage tamper protection settings on Windows 10, Windows Server 2016, and Windows Server 2019 by using a method called *tenant attach*. Tenant attach enables you to sync your on-premises-only Configuration Manager devices into the Microsoft Endpoint Manager admin center, and then deliver endpoint security configuration policies to on-premises collections & devices.
|
||||
|
||||
|
||||
|
||||
1. Set up tenant attach. See [Microsoft Endpoint Manager tenant attach: Device sync and device actions](https://docs.microsoft.com/mem/configmgr/tenant-attach/device-sync-actions).
|
||||
|
||||
2. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint security** > **Antivirus**, and choose **+ Create Policy**.<br/>
|
||||
|
||||
- In the **Platform** list, select **Windows 10 and Windows Server (ConfigMgr)**.
|
||||
|
||||
- In the **Profile** list, select **Windows Security experience (preview)**. <br/>
|
||||
|
||||
The following screenshot illustrates how to create your policy:
|
||||
|
||||
:::image type="content" source="images/win-security- exp-policy-endpt-security.png" alt-text="Windows security experience in Endpoint Manager":::
|
||||
|
||||
3. Deploy the policy to your device collection.
|
||||
|
||||
Need help? See the following resources:
|
||||
### Need help with this?
|
||||
|
||||
See the following resources:
|
||||
|
||||
- [Settings for the Windows Security experience profile in Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/antivirus-security-experience-windows-settings)
|
||||
|
||||
- [Tech Community Blog: Announcing Tamper Protection for Configuration Manager Tenant Attach clients](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/announcing-tamper-protection-for-configuration-manager-tenant/ba-p/1700246#.X3QLR5Ziqq8.linkedin)
|
||||
|
||||
## Manage tamper protection for your organization using the Microsoft Defender Security Center
|
||||
|
||||
Currently in preview, tamper protection can be turned on or off in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)). Here are a few points to keep in mind:
|
||||
|
||||
- When you use the Microsoft Defender Security Center to manage tamper protection, you do not have to use Intune or the tenant attach method.
|
||||
- When you manage tamper protection in the Microsoft Defender Security Center, the setting is applied tenant wide, affecting all of your devices that are running Windows 10, Windows Server 2016, or Windows Server 2019. To fine-tune tamper protection (such as having tamper protection on for some devices but off for others), use either [Intune](#manage-tamper-protection-for-your-organization-using-intune) or [Configuration Manager with tenant attach](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006).
|
||||
- If you have a hybrid environment, tamper protection settings configured in Intune take precedence over settings configured in the Microsoft Defender Security Center.
|
||||
- Tamper protection is generally available; however, the ability to manage tamper protection in the Microsoft Defender Security Center is currently in preview.
|
||||
|
||||
### Requirements for managing tamper protection in the Microsoft Defender Security Center
|
||||
|
||||
- You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations.
|
||||
- Your Windows devices must be running one of the following versions of Windows:
|
||||
- Windows 10
|
||||
- [Windows Server 2019](/windows-server/get-started-19/whats-new-19)
|
||||
- Windows Server, version [1803](https://docs.microsoft.com/windows/release-health/status-windows-10-1803) or later
|
||||
- [Windows Server 2016](/windows-server/get-started/whats-new-in-windows-server-2016)
|
||||
- For more information about releases, see [Windows 10 release information](https://docs.microsoft.com/windows/release-health/release-information).
|
||||
- Your devices must be [onboarded to Microsoft Defender for Endpoint](../microsoft-defender-atp/onboarding.md).
|
||||
- Your devices must be using anti-malware platform version 4.18.2010.7 (or above) and anti-malware engine version 1.1.17600.5 (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).)
|
||||
- [Cloud-delivered protection must be turned on](enable-cloud-protection-microsoft-defender-antivirus.md).
|
||||
|
||||
### Turn tamper protection on (or off) in the Microsoft Defender Security Center
|
||||
|
||||
|
||||
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in.
|
||||
2. Choose **Settings**.
|
||||
3. Go to **General** > **Advanced features**, and then turn tamper protection on.
|
||||
|
||||
## View information about tampering attempts
|
||||
|
||||
@ -200,13 +215,13 @@ Devices that are onboarded to Microsoft Defender for Endpoint will have Microsof
|
||||
|
||||
### How can I turn tamper protection on/off?
|
||||
|
||||
If you are a home user, see [Turn tamper protection on (or off) for an individual machine](#turn-tamper-protection-on-or-off-for-an-individual-machine).
|
||||
If you are a home user, see [Manage tamper protection on an individual device](#manage-tamper-protection-on-an-individual-device).
|
||||
|
||||
If you are an organization using [Microsoft Defender for Endpoint](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint), you should be able to manage tamper protection in Intune similar to how you manage other endpoint protection features. See the following sections of this article:
|
||||
|
||||
- [Turn tamper protection on (or off) for your organization using Intune](#turn-tamper-protection-on-or-off-for-your-organization-using-intune)
|
||||
|
||||
- [Manage tamper protection with Configuration Manager, version 2006](#manage-tamper-protection-with-configuration-manager-version-2006)
|
||||
- [Manage tamper protection using Intune](#manage-tamper-protection-for-your-organization-using-intune)
|
||||
- [Manage tamper protection using Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006)
|
||||
- [Manage tamper protection using the Microsoft Defender Security Center](#manage-tamper-protection-for-your-organization-using-the-microsoft-defender-security-center) (currently in preview)
|
||||
|
||||
### How does configuring tamper protection in Intune affect how I manage Microsoft Defender Antivirus through my group policy?
|
||||
|
||||
@ -218,7 +233,9 @@ Configuring tamper protection in Intune or Microsoft Endpoint Manager can be tar
|
||||
|
||||
### Can I configure Tamper Protection in Microsoft Endpoint Configuration Manager?
|
||||
|
||||
If you are using tenant attach, you can use Microsoft Endpoint Configuration Manager. See [Manage tamper protection with Configuration Manager, version 2006](#manage-tamper-protection-with-configuration-manager-version-2006) and [Tech Community blog: Announcing Tamper Protection for Configuration Manager Tenant Attach clients](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/announcing-tamper-protection-for-configuration-manager-tenant/ba-p/1700246#.X3QLR5Ziqq8.linkedin).
|
||||
If you are using tenant attach, you can use Microsoft Endpoint Configuration Manager. See the following resources:
|
||||
- [Manage tamper protection for your organization with Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006)
|
||||
- [Tech Community blog: Announcing Tamper Protection for Configuration Manager Tenant Attach clients](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/announcing-tamper-protection-for-configuration-manager-tenant/ba-p/1700246#.X3QLR5Ziqq8.linkedin)
|
||||
|
||||
### I have the Windows E3 enrollment. Can I use configuring tamper protection in Intune?
|
||||
|
||||
@ -240,7 +257,7 @@ If a device is off-boarded from Microsoft Defender for Endpoint, tamper protecti
|
||||
|
||||
Yes. The alert is shown in [https://securitycenter.microsoft.com](https://securitycenter.microsoft.com) under **Alerts**.
|
||||
|
||||
In addition, your security operations team can use hunting queries, such as the following example:
|
||||
Your security operations team can also use hunting queries, such as the following example:
|
||||
|
||||
`DeviceAlertEvents | where Title == "Tamper Protection bypass"`
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 6.4 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 129 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 107 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 23 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 23 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 38 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 70 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 73 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 2.8 KiB |
@ -0,0 +1,98 @@
|
||||
---
|
||||
title: Techniques in the device timeline
|
||||
description: Understanding the device timeline in Microsoft Defender for Endpoint
|
||||
keywords: device timeline, endpoint, MITRE, MITRE ATT&CK, techniques, tactics
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: m365-security
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: maccruz
|
||||
author: schmurky
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Techniques in the device timeline
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
|
||||
You can gain more insight in an investigation by analyzing the events that happened on a specific device. First, select the device of interest from the [Devices list](machines-view-overview.md). On the device page, you can select the **Timeline** tab to view all the events that occurred on the device.
|
||||
|
||||
## Understand techniques in the timeline
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Some information relates to a prereleased product feature in public preview which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
In Microsoft Defender for Endpoint, **Techniques** are an additional data type in the event timeline. Techniques provide more insight on activities associated with [MITRE ATT&CK](https://attack.mitre.org/) techniques or sub-techniques.
|
||||
|
||||
This feature simplifies the investigation experience by helping analysts understand the activities that were observed on a device. Analysts can then decide to investigate further.
|
||||
|
||||
For public preview, Techniques are available by default and shown together with events when a device's timeline is viewed.
|
||||
|
||||
|
||||
|
||||
Techniques are highlighted in bold text and appear with a blue icon on the left. The corresponding MITRE ATT&CK ID and technique name also appear as tags under Additional information.
|
||||
|
||||
Search and Export options are also available for Techniques.
|
||||
|
||||
## Investigate using the side pane
|
||||
|
||||
Select a Technique to open its corresponding side pane. Here you can see additional information and insights like related ATT&CK techniques, tactics, and descriptions.
|
||||
|
||||
Select the specific *Attack technique* to open the related ATT&CK technique page where you can find more information about it.
|
||||
|
||||
You can copy an entity's details when you see a blue icon on the right. For instance, to copy a related file's SHA1, select the blue page icon.
|
||||
|
||||
|
||||
|
||||
You can do the same for command lines.
|
||||
|
||||
|
||||
|
||||
|
||||
## Investigate related events
|
||||
|
||||
To use [advanced hunting](advanced-hunting-overview.md) to find events related to the selected Technique, select **Hunt for related events**. This leads to the advanced hunting page with a query to find events related to the Technique.
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Querying using the **Hunt for related events** button from a Technique side pane displays all the events related to the identified technique but does not include the Technique itself in the query results.
|
||||
|
||||
|
||||
## Customize your device timeline
|
||||
|
||||
On the upper right-hand side of the device timeline, you can choose a date range to limit the number of events and techniques in the timeline.
|
||||
|
||||
You can customize which columns to expose. You can also filter for flagged events by data type or by event group.
|
||||
|
||||
### Choose columns to expose
|
||||
You can choose which columns to expose in the timeline by selecting the **Choose columns** button.
|
||||
|
||||
|
||||
|
||||
From there you can select which information set to include.
|
||||
|
||||
### Filter to view techniques or events only
|
||||
|
||||
To view only either events or techniques, select **Filters** from the device timeline and choose your preferred Data type to view.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## See also
|
||||
- [View and organize the Devices list](machines-view-overview.md)
|
||||
- [Microsoft Defender for Endpoint device timeline event flags](device-timeline-event-flag.md)
|
||||
|
||||
|
||||
|
||||
@ -106,6 +106,8 @@ On member servers, ensure that only the Administrators and Service groups (Local
|
||||
|
||||
In most cases, this configuration has no impact. If you have installed optional components such as ASP.NET or IIS, you may need to assign the **Impersonate a client after authentication** user right to additional accounts that are required by those components, such as IUSR\_*<ComputerName>*, IIS\_WPG, ASP.NET, or IWAM\_*<ComputerName>*.
|
||||
|
||||
In IIS 7.0 and later, a built-in account (IUSR) replaces the IUSR_MachineName account. Additionally, a group that is named IIS_IUSRS replaces the IIS_WPG group. Because the IUSR account is a built-in account, the IUSR account no longer requires a password. The IUSR account resembles a network or local service account. For more details, see [Default permissions and user rights for IIS 7.0 and later](https://docs.microsoft.com/troubleshoot/iis/default-permissions-user-rights).
|
||||
|
||||
## Related topics
|
||||
|
||||
- [User Rights Assignment](user-rights-assignment.md)
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 18 KiB After Width: | Height: | Size: 16 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB After Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 49 KiB After Width: | Height: | Size: 53 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 26 KiB After Width: | Height: | Size: 27 KiB |
@ -26,7 +26,7 @@ This topic provides links to articles with information about what's new in each
|
||||
[What's New in Windows 10 Enterprise LTSC 2016](whats-new-windows-10-2016.md)<br>
|
||||
[What's New in Windows 10 Enterprise LTSC 2015](whats-new-windows-10-2015.md)
|
||||
|
||||
## The Long Term Servicing Channel (LTSC)
|
||||
## The Long-Term Servicing Channel (LTSC)
|
||||
|
||||
The following table summarizes equivalent feature update versions of Windows 10 LTSC and semi-annual channel (SAC) releases.
|
||||
|
||||
@ -37,12 +37,12 @@ The following table summarizes equivalent feature update versions of Windows 10
|
||||
| Windows 10 Enterprise LTSC 2019 | Windows 10, Version 1809 | 11/13/2018 |
|
||||
|
||||
>[!NOTE]
|
||||
>The Long Term Servicing Channel was previously called the Long Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB.
|
||||
>The Long-Term Servicing Channel was previously called the Long-Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB.
|
||||
|
||||
With the LTSC servicing model, customers can delay receiving feature updates and instead only receive monthly quality updates on devices. Features from Windows 10 that could be updated with new functionality, including Cortana, Edge, and all in-box Universal Windows apps, are also not included. Feature updates are offered in new LTSC releases every 2–3 years instead of every 6 months, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. Microsoft is committed to providing bug fixes and security patches for each LTSC release during this 10 year period.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The Long Term Servicing Channel is not intended for deployment on most or all the PCs in an organization. The LTSC edition of Windows 10 provides customers with access to a deployment option for their special-purpose devices and environments. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. These devices are also typically not heavily dependent on support from external apps and tools. Since the feature set for LTSC does not change for the lifetime of the release, over time there might be some external tools that do not continue to provide legacy support. See [LTSC: What is it, and when it should be used](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181).
|
||||
>The Long-Term Servicing Channel is not intended for deployment on most or all the PCs in an organization. The LTSC edition of Windows 10 provides customers with access to a deployment option for their special-purpose devices and environments. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. These devices are also typically not heavily dependent on support from external apps and tools. Since the feature set for LTSC does not change for the lifetime of the release, over time there might be some external tools that do not continue to provide legacy support. See [LTSC: What is it, and when it should be used](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181).
|
||||
|
||||
For detailed information about Windows 10 servicing, see [Overview of Windows as a service](/windows/deployment/update/waas-overview).
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user