diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 97a456c86d..5fb03f440d 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -14783,7 +14783,7 @@ { "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md", "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md", @@ -14793,7 +14793,7 @@ { "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md", "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md", @@ -15136,6 +15136,21 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp/is-ip-seen-org.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp/exposed-apis-list", +"redirect_document_id": false +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md", "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/machineaction", "redirect_document_id": true diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 44c558fde0..6b3a628eb7 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -9,18 +9,22 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 06/26/2017 +ms.date: 08/05/2019 --- # DiagnosticLog CSP +The DiagnosticLog configuration service provider (CSP) is used in the following scenarios: +- [Controlling ETW trace sessions](#diagnosticlog-csp-for-controlling-etw-trace-sessions) +- [Triggering devices to upload existing event logs, log files, and registry values to cloud storage](#diagnosticlog-csp-for-triggering-devices-to-upload-files-to-cloud) -The DiagnosticLog configuration service provider (CSP) is used for generating and collecting diagnostic information from the device: Event Tracing for Windows (ETW) log files and current MDM configured state of the device. +## DiagnosticLog CSP for controlling ETW trace sessions +The DiagnosticLog CSP is used for generating and collecting diagnostic information from the device: Event Tracing for Windows (ETW) log files and current MDM configured state of the device. DiagnosticLog CSP supports the following type of event tracing: -- Collector-based tracing -- Channel-based tracing +- Collector-based tracing +- Channel-based tracing ### Collector-based tracing @@ -49,11 +53,10 @@ For each registered provider in this collector, the user can: The changes on **State**, **Keywords** and **TraceLevel** takes effect immediately while trace session is in progress. -> **Note**  Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. +> [!Note] +> Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. - - -### Channel-based tracing + ### Channel-based tracing The type of event tracing exports event data from a specific channel. This is only supported on the desktop. @@ -73,36 +76,31 @@ Here are the links to the DDFs: - [DiagnosticLog CSP version 1.2](diagnosticlog-ddf.md#version-1-2) - [DiagnosticLog CSP version 1.3](diagnosticlog-ddf.md#version-1-3) +- [DiagnosticLog CSP version 1.4](diagnosticlog-ddf.md#version-1-4) -The following diagram shows the DiagnosticLog configuration service provider in tree format. +The following diagram shows the DiagnosticLog CSP in tree format. ![diagnosticlog csp diagram](images/provisioning-csp-diagnosticlog.png) **./Vendor/MSFT/DiagnosticLog** -The root node for the DiagnosticLog configuration service provider. +The root node for the DiagnosticLog CSP. -The following steps describe the process for gathering diagnostics using this CSP. +To gather diagnostics using this CSP: 1. Specify a *CollectorName* for the container of the target ETW providers. 2. (Optional) Set logging and log file parameters using the following options: - - **TraceLogFileMode** - - **LogFileSizeLimitMB** - - Each of these are described later in this topic. + - TraceLogFileMode + - LogFileSizeLimitMB 3. Indicate one or more target ETW providers by supplying its *ProviderGUID* to the Add operation of EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*. 4. (Optional) Set logging and log file parameters using the following options: - - - **TraceLevel** - - **Keywords** - - Each of these are described later in this topic. - -5. Start logging using **TraceControl** EXECUTE command “START” + - TraceLevel + - Keywords +5. Start logging using **TraceControl** EXECUTE command “START”. 6. Perform actions on the target device that will generate activity in the log files. -7. Stop logging using **TraceControl** EXECUTE command “STOP” -8. Collect the log file located in the `%temp%` folder using the method described in [Reading a log file](#reading-a-log-file) +7. Stop logging using **TraceControl** EXECUTE command “STOP”. +8. Collect the log file located in the `%temp%` folder using the method described in [Reading a log file](#reading-a-log-file). **EtwLog** Node to contain the Error Tracing for Windows log. @@ -174,8 +172,6 @@ The following table represents the possible values: | 0 | Stopped | | 1 | Started | - - **EtwLog/Collectors/*CollectorName*/TraceLogFileMode** Specifies the log file logging mode. @@ -185,30 +181,10 @@ Supported operations are Get and Replace. The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - -
ValueDescription

EVENT_TRACE_FILE_MODE_SEQUENTIAL (0x00000001)

Writes events to a log file sequentially; stops when the file reaches its maximum size.

EVENT_TRACE_FILE_MODE_CIRCULAR (0x00000002)

Writes events to a log file. After the file reaches the maximum size, the oldest events are replaced with incoming events.

- - +| Value | Description | +|-------|--------------------| +| EVENT_TRACE_FILE_MODE_SEQUENTIAL (0x00000001) | Writes events to a log file sequentially; stops when the file reaches its maximum size. | +| EVENT_TRACE_FILE_MODE_CIRCULAR (0x00000002) | Writes events to a log file. After the file reaches the maximum size, the oldest events are replaced with incoming events. | **EtwLog/Collectors/*CollectorName*/TraceControl** Specifies the logging and report action state. @@ -222,8 +198,6 @@ The following table lists the possible values: | START | Start log tracing. | | STOP | Stop log tracing | - - The supported operation is Execute. After you have added a logging task, you can start a trace by running an Execute command on this node with the value START. @@ -295,8 +269,6 @@ Dynamic nodes to represent active provider configuration per provider GUID. > **Note**  Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. - - Supported operations are Add, Delete, and Get. Add a provider @@ -347,44 +319,15 @@ The data type is an integer. Supported operations are Get and Replace. -The following table lists the possible values. +The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ValueDescription

1 – TRACE_LEVEL_CRITICAL

Abnormal exit or termination events

2 – TRACE_LEVEL_ERROR

Severe error events

3 – TRACE_LEVEL_WARNING

Warning events such as allocation failures

4 – TRACE_LEVEL_INFORMATION

Non-error events, such as entry or exit events

5 – TRACE_LEVEL_VERBOSE

Detailed information

- - +| Value | Description | +|-------|--------------------| +| 1 – TRACE_LEVEL_CRITICAL | Abnormal exit or termination events | +| 2 – TRACE_LEVEL_ERROR | Severe error events | +| 3 – TRACE_LEVEL_WARNING | Warning events such as allocation failures | +| 4 – TRACE_LEVEL_INFORMATION | Non-error events, such as entry or exit events | +| 5 – TRACE_LEVEL_VERBOSE | Detailed information | Set provider **TraceLevel** @@ -412,7 +355,7 @@ Set provider **TraceLevel** **EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*/Keywords** Specifies the provider keywords to be used as MatchAnyKeyword for this provider. -the data type is a string. +The data type is a string. Supported operations are Get and Replace. @@ -470,32 +413,11 @@ The data type is a boolean. Supported operations are Get and Replace. This change will be effective during active trace session. -The following table lists the possible values. Default value is TRUE. - - ---- - - - - - - - - - - - - - - - - -
ValueDescription

TRUE

Provider is enabled in the trace session.

FALSE

Provider is disables in the trace session.

- - +The following table lists the possible values: +| Value | Description | +|-------|--------------------| +| TRUE | Provider is enabled in the trace session. This is the default. | +| FALSE | Provider is disabled in the trace session. | Set provider **State** @@ -630,32 +552,12 @@ The data type is a boolean. Supported operations are Get and Replace. -The following table lists the possible values. +The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - -
ValueDescription

TRUE

Channel is enabled.

FALSE

Channel is disabled.

- - +| Value | Description | +|-------|--------------------| +| TRUE | Channel is enabled. | +| FALSE | Channel is disabled. | Get channel **State** @@ -897,26 +799,585 @@ Node to transfer the selected log file block to the DM server. **FileDownload/DMChannel/*FileContext*/DataBlocks/***BlockNumber* The data type is Base64. -The only supported operation is Get. +The supported operation is Get. + +**Policy** +Added in version 1.4 of the CSP in Windows 10, version 1903. Root node to control settings for channels in Event Log. + +The supported operation is Get. + +**Policy/Channels** +Added in version 1.4 of the CSP in Windows 10, version 1903. Node that contains Event Log channel settings. + +The supported operation is Get. + +**Policy/Channels/_ChannelName_** +Added in version 1.4 of the CSP in Windows 10, version 1903. Dynamic node to represent a registered channel. The node name must be a valid Windows event log channel name, such as ``Microsoft-Client-Licensing-Platform%2FAdmin``. When specifying the name in the LocURI, it must be URL encoded, otherwise it may unexpectedly translate into a different URI. + +Supported operations are Add, Delete, and Get. + +Add **Channel** +``` xml + + ​ + ​ + 2​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + node​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Delete **Channel** +``` xml + + ​ + ​ + 3​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Get **Channel** +``` xml + + ​ + ​ + 4​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +**Policy/Channels/_ChannelName_/MaximumFileSize** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting specifies the maximum size of the log file in megabytes. + +If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte and 2 terabytes in megabyte increments. + +If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is integer. + +Add **MaximumFileSize** +``` xml + + ​ + ​ + 6​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + int​ + text/plain​ + ​ + 3​ + ​ + ​ + ​ + ​ + +``` + +Delete **MaximumFileSize** +``` xml + + ​ + ​ + 7​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Get **MaximumFileSize** +``` xml + + ​ + ​ + 5​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **MaximumFileSize** +``` xml + + ​ + ​ + 8​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + int​ + text/plain​ + ​ + 5​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/SDDL** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting represents SDDL string controlling access to the channel. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is string. + +Default string is as follows: + +https://docs.microsoft.com/en-us/windows/desktop/WES/eventmanifestschema-channeltype-complextype. + +Add **SDDL** +``` xml + + ​ + ​ + 10​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + YourSDDL​ + ​ + ​ + ​ + ​ + +``` + +Delete **SDDL** +``` xml + + + ​ + ​ + 11​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Get **SDDL** +``` xml + + ​ + ​ + 9​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **SDDL** +``` xml + + ​ + ​ + 12​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + YourNewSDDL​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/ActionWhenFull** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is string. + +The following are the possible values: +- Truncate — When the log file reaches its maximum file size, new events are not written to the log and are lost. +- Overwrite — When the log file reaches its maximum file size, new events overwrite old events. +- Archive — When the log file reaches its maximum size, the log file is saved to the location specified by the "Archive Location" policy setting. If archive location value is not set, the new file is saved in the same directory as current log file. + +If you disable or do not configure this policy setting, the locally configured value will be used as default. Every channel that is installed, whether inbox or by ISVs, is responsible for defining its own local configuration, and that configuration can be changed by any administrator. Values set via this policy override but do not replace local configuration. + + +Add **ActionWhenFull** +``` xml + + ​ + ​ + 14​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + Archive​ + ​ + ​ + ​ + ​ + +``` + +Delete **ActionWhenFull** +``` xml + + ​ + ​ + 15​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Get **ActionWhenFull** +``` xml + + ​ + ​ + 13​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **ActionWhenFull** +``` xml + + ​ + ​ + 16​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + Truncate​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/Enabled** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting specifies whether the channel should be enabled or disabled. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is boolean. + +The following are the possible values: +- TRUE — Enables the channel. +- FALSE — Disables the channel. + +If you disable or do not configure this policy setting, the locally configured value is used as default. + +Get **Enabled** +``` xml + + ​ + ​ + 17​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Add **Enabled** +``` xml + + ​ + ​ + 18​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + bool​ + text/plain​ + ​ + TRUE​ + ​ + ​ + ​ + ​ + +``` + +Delete **Enabled** +``` xml + + ​ + ​ + 19​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **Enabled** +``` xml + + ​ + ​ + 20​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + bool​ + text/plain​ + ​ + FALSE​ + ​ + ​ + ​ + ​ + +``` + +## DiagnosticLog CSP for triggering devices to upload files to cloud +The DiagnosticLog CSP is used for triggering devices to upload existing event logs, log files, and registry values to cloud storage. The following section describes the nodes for the DiagnosticArchive functionality. + +**DiagnosticArchive** +Added in version 1.4 of the CSP in Windows 10, version 1903. Root note for the DiagnosticArchive functionality. + +The supported operation is Get. + +**DiagnosticArchive/ArchiveDefinition** +Added in version 1.4 of the CSP in Windows 10, version 1903. + +The supported operations are Add and Execute. + +The data type is string. + +Expected value: +Set and Execute are functionality equivalent, and each accepts an XML snippet (as a string) describing what data to gather and where to upload it when done. This XML defines what should be collected and compressed into a zip file to be uploaded to Azure blog storage. + +The following is an example of the XML. This example instructs that a zip file be created containing the output from a dump of the specified registry key, all the files in a folder, the output of two commands, all the files in another folder, the output of a command, all the Application events, two sets of files, and another command output. All of this will be uploaded to the blob storage URL as specified in the tags and must be in the noted format with the container and the key in the URL. The administrator can retrieve this URL from Azure. The file uploaded will be in the format DiagLogs-{ComputerName}-YYYYMMDDTHHMMSSZ.zip. + +``` xml + + f1e20cb4-9789-4f6b-8f6a-766989764c6d + {web address}/{container}{key} + HKLM\Software\Policies + C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %windir%\system32\ipconfig.exe /all + %windir%\system32\mdmdiagnosticstool.exe -out c:\ProgramData\temp\ + c:\ProgramData\temp\*.* + %windir%\system32\ping.exe -n 50 localhost + Application + %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %SystemRoot%\System32\LogFiles\wmi\*.etl.* + + %windir%\system32\pnputil.exe /enum-drivers + + +``` +Where: + +- ID is a unique GUID value that defines this particular run of the DiagnosticLog CSP. +- There can be multiple RegistryKey, FolderFiles, Command, and Events elements, which extract or execute and collect the output from the action specified. +- SasUrl is generated from the Azure Blob Storage UX in Azure such that it will allow write access to the blob to upload the zip file created by all the actions specified. + +**DiagnosticArchive/ArchiveResults** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting displays the results of the last archive run. + +The supported operation is Get. + +The data type is string. + +A Get to the above URI will return the results of the gathering of data for the last diagnostics request. For the example above it returns: + +``` xml + + + + + 1 + 1 + 0 + SyncHdr + 200 + + + 2 + 1 + 1 + Get + 200 + + + 3 + 1 + 1 + + + ./Vendor/MSFT/DiagnosticLog/DiagnosticArchive/ArchiveResults + + + + f1e20cb4-9789-4f6b-8f6a-766989764c6d + HKLM\Software\Policies + C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %windir%\system32\ipconfig.exe /all + %windir%\system32\mdmdiagnosticstool.exe -out c:\ProgramData\temp\ + c:\ProgramData\temp\*.* + %windir%\system32\ping.exe -n 50 localhost + Application + %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %SystemRoot%\System32\LogFiles\wmi\*.etl.* + %windir%\system32\pnputil.exe /enum-drivers + + + + + + + +``` +> [!Note] +> Each data gathering node is annotated with the HRESULT of the option and the collection is also annotated with an HRESULT. In this example, note that the mdmdiagnosticstool.exe command failed. ## Reading a log file - - -1. Enumerate log file under **./Vendor/MSFT/DiagnosticLog/FileDownload/DMChannel** -2. Select a log file in the Enumeration result -3. Set **BlockSizeKB** per DM server payload limitation -4. Get **BlockCount** to determine total read request -5. Set **BlockIndexToRead** to initialize read start point -6. Get **BlockData** for upload log block -7. Increase **BlockIndexToRead** -8. Repeat step 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)** - - - - - - - - - - +To read a log file: +1. Enumerate log file under **./Vendor/MSFT/DiagnosticLog/FileDownload/DMChannel**. +2. Select a log file in the Enumeration result. +3. Set **BlockSizeKB** per DM server payload limitation. +4. Get **BlockCount** to determine total read request. +5. Set **BlockIndexToRead** to initialize read start point. +6. Get **BlockData** for upload log block. +7. Increase **BlockIndexToRead**. +8. Repeat step 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)**. \ No newline at end of file diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index dc23032029..ec63a3f303 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -23,6 +23,7 @@ The content below are the latest versions of the DDF files: - [DiagnosticLog CSP version 1.2](#version-1-2) - [DiagnosticLog CSP version 1.3](#version-1-3) +- [DiagnosticLog CSP version 1.4](#version-1-4) ## DiagnosticLog CSP version 1.2 @@ -1284,6 +1285,893 @@ The content below are the latest versions of the DDF files: ``` +## DiagnosticLog CSP version 1.4 +```xml + + +]> + + 1.2 + + DiagnosticLog + ./Vendor/MSFT + + + + + + + + + + + + + + + com.microsoft/1.4/MDM/DiagnosticLog + + + + EtwLog + + + + + Root node of all types of event logging nodes that CSP manages. + + + + + + + + + + + + + + + Collectors + + + + + Root node of registered "Collector" nodes. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Collector' node. CSP will maintain an ETW trace session for this collector with its name used as a unique identifier. In a collector, a valid ETW provider can be registered and unregistered. The collector's associated trace session will enable the registered providers in it if the provider's state is 'Enabled'. Each provider's state, trace level and keywords can be controlled separately. The name of this node must not be a valid Windows event channel name. It can be a etw provider guid as long as it is not equal to an already registered 'Provider' node name. + + + + + + + + + + CollectorName + + + + + + TraceStatus + + + + + This node is used for getting the status of this collector node's associated trace session. 1 means "in progress"; 0 means "not started or stopped". + + + + + + + + + + + text/plain + + + + + TraceLogFileMode + + + + + + 1 + This node is used for setting or getting the trace log file mode of this collector node's associated trace session. The only two allowed values are 1 and 2, which are EVENT_TRACE_FILE_MODE_SEQUENTIAL and EVENT_TRACE_FILE_MODE_CIRCULAR. Default value is 1. + + + + + + + + + + + text/plain + + + + + TraceControl + + + + + + This node is to trigger "start" and "stop" of this collector node's associated trace session. "Get" returns the name of this node. + + + + + + + + + + + text/plain + + + + + LogFileSizeLimitMB + + + + + + 4 + This node is used for setting or getting the trace log file size limit(in Megabytes) of this collector node's associated trace session. The value range is 1~2048. Default value is 4. + + + + + + + + + + + text/plain + + + + + Providers + + + + + Root node of all providers registered in this collector node. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents an ETW provider registered in this collector node. The node name must be a valid provider GUID. + + + + + + + + + + ProviderGuid + + + + + + Keywords + + + + + + "0" + This node is used for setting or getting the keywords of the event provider in this collector node's associated trace session. The string is in the form of hexadecimal digits and 16 chars wide. It'll be internally converted into ULONGLONG data type in the CSP. Default value is "0", which means all events from this provider are included. If the associated trace session is in progress, new keywords setting is applied immediately; if not, it'll be applied next time that session is started. + + + + + + + + + + + text/plain + + + + + TraceLevel + + + + + + 5 + This node is used for setting or getting the trace level of this event provider in this collector node's associated trace session. Default value is 5, which is TRACE_LEVEL_VERBOSE. If the associated trace session is in progress, new trace level setting is applied immediately;if not, it'll be applied next time that session is started. + + + + + + + + + + + text/plain + + + + + State + + + + + + true + This node is used for setting or getting the state of the event provider in this collector node's associated trace session. If the trace session isn't started, changing the value controls whether to enable the provider or not when session is started; if trace session is already started, changing its value causes enabling or disabling the provider in the live trace session. Default value is true. + + + + + + + + + + + text/plain + + + + + + + + + Channels + + + + + Root node of registered "Channel" nodes. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Channel' node. The node name must be a valid Windows event log channel name, e.g. "Microsoft-Client-Licensing-Platform%2FAdmin". When specifying the name in the LocURI, it must be url encoded or it'll be translated into a different URI unexpectedly. + + + + + + + + + + ChannelName + + + + + + Export + + + + + + This node is to trigger exporting events into a log file from this node's associated Windows event channel. The log file's extension is .evtx, which is the standard extension of windows event channel log. The "Get" command returns the name of this node. + + + + + + + + + + + text/plain + + + + + State + + + + + + This node is used for setting or getting the 'Enabled' state of this node's associated windows event channel in the system. Setting it to "TRUE" enables the channel; setting it to "FALSE" disables the channel. + + + + + + + + + + + text/plain + + + + + Filter + + + + + + "" + This node is used for setting or getting the xpath query string to filter the events when exporting the log file from the channel. Default value is empty string. + + + + + + + + + + + text/plain + + + + + + + + DeviceStateData + + + + + Root node of all types of device state data that CSP exposes. + + + + + + + + + + + + + + + MdmConfiguration + + + + + This node is to trigger snapping of the Device Management state data with "SNAP". + + + + + + + + + + + text/plain + + + + + + FileDownload + + + + + Root node of all csp nodes that are related to log file download in csp. + + + + + + + + + + + + + + + DMChannel + + + + + Root node of all csp nodes that are used for controlling file download for their associated log file generated by logging csp nodes. + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a 'FileContext' node corresponding to a log file generated by one of the logging CSP nodes(underneath 'EtwLog' node). The node name must be the name of a registered 'Provider', 'Collector' or 'Channel' node. The log file and its location will be determined by CSP based on the node name. File download is done by dividing the log file into multiple blocks of configured block size and then sending the blocks as requested by MDM server. + + + + + + + + + + FileContext + + + + + + BlockSizeKB + + + + + + 4 + This node is used for setting or getting the block size (in Kilobytes) for the download of assoicated log file. The value range is 1~16. Default value is 4. + + + + + + + + + + + text/plain + + + + + BlockCount + + + + + This node is used for getting the total number of blocks for the associated log file. If the log file isn't generated yet, the value returned is -1; if the trace session is in progress, the value returned is -2. + + + + + + + + + + + text/plain + + + + + BlockIndexToRead + + + + + + This node is used for setting and getting the block index that points to the data block for 'BlockData' node. The value range is 0~(BlockCount-1). + + + + + + + + + + + text/plain + + + + + BlockData + + + + + This node is used to get the binary data of the block that 'BlockIndexToRead' node is pointing to. + + + + + + + + + + + + + + + + DataBlocks + + + + + Root node of all 'BlockNumber' nodes for the associated log file. The number of its children should be the total block count of the log file. No children nodes exist if 'BlockCount' node's value is less than 0. + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a 'BlockNumber' node. The node name is an integer equal to the index of the block which this node stands for. Therefore the node name should be ranging from 0 to (BlockCount -1). It returns the binary data of the block which this node is referring to. + + + + + + + + + + BlockNumber + + + + + + + + + + + Policy + + + + + Contains policy for diagnostic settings. + + + + + + + + + + + + + + + + + + Channels + + + + + Contains policy for Event Log channel settings. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Channel' node. The node name must be a valid Windows event log channel name, e.g. "Microsoft-Client-Licensing-Platform%2FAdmin". When specifying the name in the LocURI, it must be url encoded or it'll be translated into a different URI unexpectedly. + + + + + + + + + + ChannelName + + + + + + MaximumFileSize + + + + + + + + Maximum size of the channel log file in MB. + + + + + + + + + + + text/plain + + + + + SDDL + + + + + + + + SDDL String controlling access to the channel. Default: https://docs.microsoft.com/en-us/windows/desktop/WES/eventmanifestschema-channeltype-complextype + + + + + + + + + + + + + + text/plain + + + + + ActionWhenFull + + + + + + + + Action to take when the log file reaches maximum size. "Truncate", "Overwrite", "Archive". + + + + + + + + + + + + + + text/plain + + + + + Enabled + + + + + + + + This policy setting specifies whether the channel should be enabled or disabled. Set value to TRUE to enable and FALSE to disable. + + + + + + + + + + + text/plain + + + + + + + + DiagnosticArchive + + + + + Root note for archive definition and collection. + + + + + + + + + + + + + + + ArchiveDefinition + + + + + + + + + + + + + + + + text/plain + + + + + ArchiveResults + + + + + Pull up the results of the last archive run. + + + + + + + + + + + + + + text/plain + + + + + + +``` + ## Related topics diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 9f3f924a14..714c0ec093 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -22,6 +22,7 @@ Requirements: - The enterprise has configured a mobile device management (MDM) service - The enterprise AD must be [registered with Azure Active Directory (Azure AD)](azure-active-directory-integration-with-mdm.md) - The device should not already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`) +- The minimum Windows Server version requirement is based on the Hybrid AAD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan) for more information. > [!TIP] > For additional information, see the following topics: diff --git a/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png b/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png index 44449d7e6f..9829586338 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png and b/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png differ diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index f12fe88286..0e6b603e24 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -144,6 +144,13 @@ For details about Microsoft mobile device management protocols for Windows 10 s

Added new CSP in Windows 10, version 1903.

+DiagnosticLog CSP
+DiagnosticLog DDF +

Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
+Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults. +

+ + EnrollmentStatusTracking CSP

Added new CSP in Windows 10, version 1903.

@@ -1896,6 +1903,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o |New or updated topic | Description| |--- | ---| +|[DiagnosticLog CSP](diagnosticlog-csp.md)
[DiagnosticLog DDF](diagnosticlog-ddf.md)|Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.| |[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Enhanced the article to include additional reference links and the following two topics:
Verify auto-enrollment requirements and settings, Troubleshoot auto-enrollment of devices.| ### July 2019 diff --git a/windows/release-information/resolved-issues-windows-10-1803.yml b/windows/release-information/resolved-issues-windows-10-1803.yml index b3059b9fe8..f6b4c85fb6 100644 --- a/windows/release-information/resolved-issues-windows-10-1803.yml +++ b/windows/release-information/resolved-issues-windows-10-1803.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: " + @@ -58,6 +59,15 @@ sections:
" +- title: September 2019 +- items: + - type: markdown + text: " +
SummaryOriginating updateStatusDate resolved
Notification issue: \"Your device is missing important security and quality fixes.\"
Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"

See details >		N/A

Resolved
September 03, 2019
12:32 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 17134.829

June 11, 2019
KB4503286		Resolved
KB4512509		August 19, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 17134.950

August 13, 2019
KB4512501		Resolved
KB4512509		August 19, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		August 13, 2019
10:00 AM PT
+ +
DetailsOriginating updateStatusHistory
Notification issue: \"Your device is missing important security and quality fixes.\"
Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.

Affected platforms:
  • Client: Windows 10, version 1803
  • Server: Windows Server, version 1803
Resolution: This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting Check for Updates in the Windows Update dialog. For instructions, see Update Windows 10. Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes. 

Back to top		N/A

Resolved
Resolved:
September 03, 2019
12:32 PM PT

Opened:
September 03, 2019
12:32 PM PT
+ " + - title: August 2019 - items: - type: markdown diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml index c70c55ae78..99b8f5966a 100644 --- a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml @@ -55,12 +55,6 @@ sections:
End-user-defined characters (EUDC) may cause blue screen at startup
If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.

See details >OS Build 17763.404

April 02, 2019
KB4490481Resolved
KB4493509April 09, 2019
10:00 AM PT
MSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

See details >OS Build 17763.253

January 08, 2019
KB4480116Resolved
KB4493509April 09, 2019
10:00 AM PT
Error 1309 when installing/uninstalling MSI or MSP files
Users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.

See details >OS Build 17763.316

February 12, 2019
KB4487044Resolved
KB4489899March 12, 2019
10:00 AM PT -
Internet Explorer may fail to load images
Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

See details >OS Build 17763.316

February 12, 2019
KB4487044Resolved
KB4482887March 01, 2019
10:00 AM PT -
First character of the Japanese era name not recognized
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

See details >OS Build 17763.316

February 12, 2019
KB4487044Resolved
KB4482887March 01, 2019
10:00 AM PT -
Applications using Microsoft Jet database and Access 95 file format stop working
Applications that use a Microsoft Jet database with the Microsoft Access 9 file format may randomly stop working.

See details >OS Build 17763.316

February 12, 2019
KB4487044Resolved
KB4482887March 01, 2019
10:00 AM PT -
Shared albums may not sync with iCloud for Windows
Upgrade block: Apple has identified an incompatibility with iCloud for Windows (version 7.7.0.27) where users may experience issues updating or synching Shared Albums.

See details >OS Build 17763.134

November 13, 2018
KB4467708Resolved
KB4482887March 01, 2019
10:00 AM PT -
Intel Audio Display (intcdaud.sys) notification during Windows 10 Setup
Upgrade block: Users may see an Intel Audio Display (intcdaud.sys) notification during setup for devices with certain Intel Display Audio Drivers.

See details >OS Build 17763.134

November 13, 2018
KB4467708Resolved
KB4482887March 01, 2019
10:00 AM PT -
F5 VPN clients losing network connectivity
Upgrade block: After updating to Windows 10, version 1809, F5 VPN clients may lose network connectivity when the VPN service is in a split tunnel configuration.

See details >OS Build 17763.134

November 13, 2018
KB4467708Resolved
KB4482887March 01, 2019
10:00 AM PT
Global DNS outage affects Windows Update customers
Windows Update customers were recently affected by a network infrastructure event caused by an external DNS service provider's global outage.

See details >N/A

Resolved
March 08, 2019
11:15 AM PT
Apps may stop working after selecting an audio output device other than the default
Users with multiple audio devices that select an audio output device different from the \"Default Audio Device\" may find certain applications stop working unexpectedly.

See details >OS Build 17763.348

March 01, 2019
KB4482887Resolved
KB4490481April 02, 2019
10:00 AM PT @@ -148,9 +142,6 @@ sections: - - -
DetailsOriginating updateStatusHistory
Embedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
 
For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
 
Affected platforms:  
  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1  
  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2  
Resolution: This issue is resolved in KB4493509.  

Back to top		OS Build 17763.316

February 12, 2019
KB4487044		Resolved
KB4493509		Resolved:
April 09, 2019
10:00 AM PT

Opened:
February 12, 2019
10:00 AM PT
Error 1309 when installing/uninstalling MSI or MSP files
After installing KB4487044, users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files. 

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
Resolution: This issue is resolved in KB4489899. 

Back to top		OS Build 17763.316

February 12, 2019
KB4487044		Resolved
KB4489899		Resolved:
March 12, 2019
10:00 AM PT

Opened:
February 12, 2019
10:00 AM PT
Internet Explorer may fail to load images
After installing KB4487044, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
Resolution: This issue is resolved in KB4482887.

Back to top		OS Build 17763.316

February 12, 2019
KB4487044		Resolved
KB4482887		Resolved:
March 01, 2019
10:00 AM PT

Opened:
February 12, 2019
10:00 AM PT
First character of the Japanese era name not recognized
After installing KB4487044, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues. 

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue is resolved in KB4482887. 

Back to top		OS Build 17763.316

February 12, 2019
KB4487044		Resolved
KB4482887		Resolved:
March 01, 2019
10:00 AM PT

Opened:
February 12, 2019
10:00 AM PT
Applications using Microsoft Jet database and Access 95 file format stop working
Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue is resolved in KB4482887.

Back to top		OS Build 17763.316

February 12, 2019
KB4487044		Resolved
KB4482887		Resolved:
March 01, 2019
10:00 AM PT

Opened:
February 12, 2019
10:00 AM PT
" @@ -171,8 +162,5 @@ sections: text: " - - -
DetailsOriginating updateStatusHistory
Audio not working on monitors or TV connected to a PC via HDMI, USB, or DisplayPort
Upgrade block: Microsoft has identified issues with certain new Intel display drivers. Intel inadvertently released versions of its display driver (versions 24.20.100.6344, 24.20.100.6345) to OEMs that accidentally turned on unsupported features in Windows. 
 
As a result, after updating to Windows 10, version 1809, audio playback from a monitor or television connected to a PC via HDMI, USB-C, or a DisplayPort may not function correctly on devices with these drivers.
Note: This Intel display driver issue is different from the Intel Smart Sound Technology driver (version 09.21.00.3755) audio issue previously documented.

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
  • Server: Windows Server, version 1809; Windows Server 2019 
Next steps: Intel has released updated drivers to OEM device manufacturers. OEMs need to make the updated driver available via Windows Update. For more information, see the Intel Customer Support article.

Resolution: Microsoft has removed the safeguard hold.



Back to top		OS Build 17763.134

November 13, 2018
KB4467708		Resolved
Resolved:
May 21, 2019
07:42 AM PT

Opened:
November 13, 2018
10:00 AM PT
Shared albums may not sync with iCloud for Windows
Upgrade block: Users who attempt to install iCloud for Windows (version 7.7.0.27) will see a message displayed that this version iCloud for Windows isn't supported and the install will fail.

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
  • Server: Windows Server, version 1809; Windows Server 2019
To ensure a seamless experience, Microsoft is blocking devices with iCloud for Windows (version 7.7.0.27) software installed from being offered Windows 10, version 1809 until this issue has been resolved. 

We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool from the Microsoft software download website until this issue is resolved. 
 
Resolution: Apple has released an updated version of iCloud for Windows (version 7.8.1) that resolves compatibility issues encountered when updating or synching Shared Albums after updating to Windows 10, version 1809. We recommend that you update your iCloud for Windows to version 7.8.1 when prompted before attempting to upgrade to Windows 10, version 1809. You can also manually download the latest version of iCloud for Windows by visiting https://support.apple.com/HT204283.

Back to top		OS Build 17763.134

November 13, 2018
KB4467708		Resolved
KB4482887		Resolved:
March 01, 2019
10:00 AM PT

Opened:
November 13, 2018
10:00 AM PT
Intel Audio Display (intcdaud.sys) notification during Windows 10 Setup
Upgrade block: Microsoft and Intel have identified a compatibility issue with a range of Intel Display Audio device drivers (intcdaud.sys, versions 10.25.0.3 - 10.25.0.8) that may result in excessive processor demand and reduced battery life. As a result, the update process to the Windows 10 October 2018 Update (Windows 10, version 1809) will fail and affected devices will automatically revert to the previous working configuration. 

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
  • Server: Windows Server, version 1809; Windows Server 2019
If you see a \"What needs your attention\" notification during installation of the October 2018 Update, you have one of these affected drivers on your system. On the notification, click Back to remain on your current version of Windows 10. 
 
To ensure a seamless experience, we are blocking devices from being offered the October 2018 Update until updated Intel device drivers are installed on your current operating system. We recommend that you do not attempt to manually update to Windows 10, version 1809, using the Update Now button or the Media Creation Tool from the Microsoft Software Download Center until newer Intel device drivers are available with the update. You can either wait for newer drivers to be installed automatically through Windows Update or check with your computer manufacturer for the latest device driver software availability and installation procedures. For more information about this issue, see Intel's customer support guidance.
 
Resolution: This issue was resolved in KB4482887 and the upgrade block removed. 

Back to top		OS Build 17763.134

November 13, 2018
KB4467708		Resolved
KB4482887		Resolved:
March 01, 2019
10:00 AM PT

Opened:
November 13, 2018
10:00 AM PT
F5 VPN clients losing network connectivity
Upgrade block: After updating to Windows 10, version 1809, F5 VPN clients may lose network connectivity when the VPN service is in a split tunnel configuration.

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
  • Server: Windows Server, version 1809; Windows Server 2019
Resolution: This issue was resolved in KB4482887 and the upgrade block removed. 

Back to top		OS Build 17763.134

November 13, 2018
KB4467708		Resolved
KB4482887		Resolved:
March 01, 2019
10:00 AM PT

Opened:
November 13, 2018
10:00 AM PT
" diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml index 46128ad713..e3349d1356 100644 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ b/windows/release-information/resolved-issues-windows-10-1903.yml @@ -32,6 +32,12 @@ sections: - type: markdown text: " + + + + + + @@ -58,10 +64,24 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 18362.295

August 13, 2019
KB4512508		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Issues updating when certain versions of Intel storage drivers are installed
Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Initiating a Remote Desktop connection may result in black screen
When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Windows Sandbox may fail to start with error code “0x80070002”
Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates

See details >		OS Build 18362.116

May 20, 2019
KB4505057		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 18362.175

June 11, 2019
KB4503293		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 18362.175

June 11, 2019
KB4503293		Resolved External
August 09, 2019
07:03 PM PT
Display brightness may not respond to adjustments
Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.

See details >		OS Build 18362.116

May 21, 2019
KB4505057		Resolved
KB4505903		July 26, 2019
02:00 PM PT
RASMAN service may stop working and result in the error “0xc0000005”
The Remote Access Connection Manager (RASMAN) service may stop working and result in the error “0xc0000005” with VPN profiles configured as an Always On VPN connection.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4505903		July 26, 2019
02:00 PM PT
+
DetailsOriginating updateStatusHistory
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
After installing KB4512508, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4512941. The ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512941 and install. For instructions, see Update Windows 10.

Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

Back to top		OS Build 18362.295

August 13, 2019
KB4512508		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
August 14, 2019
03:34 PM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503293) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

Back to top		OS Build 18362.175

June 11, 2019
KB4503293		Resolved External
Last updated:
August 09, 2019
07:03 PM PT

Opened:
August 09, 2019
04:25 PM PT
" +- title: July 2019 +- items: + - type: markdown + text: " + + + + + +
DetailsOriginating updateStatusHistory
Issues updating when certain versions of Intel storage drivers are installed
Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Workaround: To mitigate this issue before the safeguard hold is removed, you will need to update the Intel RST drivers for your device to version 15.5.2.1054 or a later.  Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You can also download the latest Intel RST drivers directly from Intel at Intel® Rapid Storage Technology (Intel® RST) User Interface and Driver. Once your drivers are updated, you can restart the installation process for Windows 10, version 1903. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

Resolution: This issue was resolved in KB4512941. The safeguard hold is estimated to be removed in early September.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Initiating a Remote Desktop connection may result in black screen
When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Resolution: This issue was resolved in KB4512941.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 12, 2019
04:42 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503293 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512941.

Back to top		OS Build 18362.175

June 11, 2019
KB4503293		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512941. The safeguard hold is estimated to be removed in early September.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
+ " + - title: June 2019 - items: - type: markdown @@ -77,6 +97,7 @@ sections: - type: markdown text: " + diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml index c9f0739b5a..fe3c6577c2 100644 --- a/windows/release-information/status-windows-10-1803.yml +++ b/windows/release-information/status-windows-10-1803.yml @@ -65,6 +65,7 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

DetailsOriginating updateStatusHistory
Windows Sandbox may fail to start with error code “0x80070002”
Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: This issue was resolved in KB4512941.

Back to top		OS Build 18362.116

May 20, 2019
KB4505057		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
May 24, 2019
04:20 PM PT
Display brightness may not respond to adjustments
Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Windows 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.

To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: This issue was resolved in KB4505903 and the safeguard hold has been removed. Please ensure you have applied the resolving update before attempting to update to the Windows 10 May 2019 Update (version 1903). Please note, it can take up to 48 hours for the safeguard to be removed.

Back to top		OS Build 18362.116

May 21, 2019
KB4505057		Resolved
KB4505903		Resolved:
July 26, 2019
02:00 PM PT

Opened:
May 21, 2019
07:56 AM PT
Loss of functionality in Dynabook Smartphone Link app
Some users may experience a loss of functionality after updating to Windows 10, version 1903 when using the Dynabook Smartphone Link application on Windows devices. Loss of functionality may affect the display of phone numbers in the Call menu and the ability to answer phone calls on the Windows PC.

To safeguard your update experience, we have applied a compatibility hold on devices with Dynabook Smartphone Link from being offered Windows 10, version 1903, until this issue is resolved.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

Back to top		OS Build 18362.116

May 20, 2019
KB4505057		Resolved
Resolved:
July 11, 2019
01:54 PM PT

Opened:
May 24, 2019
03:10 PM PT
Error attempting to update with external USB device or memory card attached
If you have an external USB device or SD memory card attached when installing Windows 10, version 1903, you may get an error message stating \"This PC can't be upgraded to Windows 10.\" This is caused by inappropriate drive reassignment during installation.

Sample scenario: An update to Windows 10, version 1903 is attempted on a computer that has a thumb drive inserted into its USB port. Before the update, the thumb drive is mounted in the system as drive G based on the existing drive configuration. After the feature update is installed; however, the device is reassigned a different drive letter (e.g., drive H).

Note The drive reassignment is not limited to removable drives. Internal hard drives may also be affected.

To safeguard your update experience, we have applied a hold on devices with an external USB device or SD memory card attached from being offered Windows 10, version 1903 until this issue is resolved.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

Back to top		OS Build 18362.116

May 21, 2019
KB4505057		Resolved
Resolved:
July 11, 2019
01:53 PM PT

Opened:
May 21, 2019
07:38 AM PT
+ @@ -81,6 +82,15 @@ sections:
" +- title: September 2019 +- items: + - type: markdown + text: " +
SummaryOriginating updateStatusLast updated
Notification issue: \"Your device is missing important security and quality fixes.\"
Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"

See details >		N/A

Resolved
September 03, 2019
12:32 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 17134.829

June 11, 2019
KB4503286		Resolved
KB4512509		August 19, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 17134.950

August 13, 2019
KB4512501		Resolved
KB4512509		August 19, 2019
02:00 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		August 13, 2019
10:00 AM PT
+ +
DetailsOriginating updateStatusHistory
Notification issue: \"Your device is missing important security and quality fixes.\"
Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.

Affected platforms:
  • Client: Windows 10, version 1803
  • Server: Windows Server, version 1803
Resolution: This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting Check for Updates in the Windows Update dialog. For instructions, see Update Windows 10. Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes. 

Back to top		N/A

Resolved
Resolved:
September 03, 2019
12:32 PM PT

Opened:
September 03, 2019
12:32 PM PT
+ " + - title: August 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index ceed17f7b4..72034e1a27 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -65,18 +65,17 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- - + + + + + + - - - - - @@ -95,7 +94,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Windows Sandbox may fail to start with error code “0x80070002”
Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates

See details >		OS Build 18362.116

May 20, 2019
KB4505057		Investigating
KB4512941		August 20, 2019
11:06 AM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 18362.295

August 13, 2019
KB4512508		Investigating
KB4512941		August 17, 2019
01:49 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 18362.295

August 13, 2019
KB4512508		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Issues updating when certain versions of Intel storage drivers are installed
Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Initiating a Remote Desktop connection may result in black screen
When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Windows Sandbox may fail to start with error code “0x80070002”
Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates

See details >		OS Build 18362.116

May 20, 2019
KB4505057		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 18362.175

June 11, 2019
KB4503293		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Updates may fail to install and you may receive Error 0x80073701
Installation of updates may fail and you may receive an error, \"Updates Failed, There were problems installing some updates, but we'll try again later\" and \"Error 0x80073701.\"

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
August 16, 2019
04:28 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
KB4512941		August 13, 2019
06:59 PM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

See details >		OS Build 18362.175

June 11, 2019
KB4503293		Resolved External
August 09, 2019
07:03 PM PT
Issues updating when certain versions of Intel storage drivers are installed
Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Mitigated External
August 09, 2019
07:03 PM PT
Intermittent loss of Wi-Fi connectivity
Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

See details >		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated External
August 01, 2019
08:44 PM PT
Gamma ramps, color profiles, and night light settings do not apply in some cases
Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

See details >		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated
August 01, 2019
06:27 PM PT
Display brightness may not respond to adjustments
Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.

See details >		OS Build 18362.116

May 21, 2019
KB4505057		Resolved
KB4505903		July 26, 2019
02:00 PM PT
The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU
Some apps or games that needs to perform graphics intensive operations may close or fail to open on Surface Book 2 devices with Nvidia dGPU.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
July 16, 2019
09:04 AM PT
Initiating a Remote Desktop connection may result in black screen
When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
KB4512941		July 12, 2019
04:42 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 18362.175

June 11, 2019
KB4503293		Mitigated
KB4512941		July 10, 2019
07:09 PM PT
Unable to discover or connect to Bluetooth devices
Microsoft has identified compatibility issues with some versions of Realtek and Qualcomm Bluetooth radio drivers.

See details >		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated
May 21, 2019
04:48 PM PT
Intel Audio displays an intcdaud.sys notification
Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in battery drain.

See details >		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated
May 21, 2019
04:47 PM PT
Cannot launch Camera app
Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.

See details >		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated
May 21, 2019
04:47 PM PT
- +
DetailsOriginating updateStatusHistory
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
After installing KB4512508, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Next steps: Microsoft is working on a resolution and estimates a solution will be available late August. The ‘optional’ update will be available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive the update once it is released.

Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

Back to top		OS Build 18362.295

August 13, 2019
KB4512508		Investigating
KB4512941		Last updated:
August 17, 2019
01:49 PM PT

Opened:
August 14, 2019
03:34 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
After installing KB4512508, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in KB4512941. The ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512941 and install. For instructions, see Update Windows 10.

Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

Back to top		OS Build 18362.295

August 13, 2019
KB4512508		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
August 14, 2019
03:34 PM PT
Updates may fail to install and you may receive Error 0x80073701
Installation of updates may fail and you may receive the error message, \"Updates Failed, There were problems installing some updates, but we'll try again later\" or \"Error 0x80073701\" on the Windows Update dialog or within Update history.

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Next steps: We are working on a resolution and will provide an update in an upcoming release.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
Last updated:
August 16, 2019
04:28 PM PT

Opened:
August 16, 2019
01:41 PM PT
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503293) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

Back to top		OS Build 18362.175

June 11, 2019
KB4503293		Resolved External
Last updated:
August 09, 2019
07:03 PM PT

Opened:
August 09, 2019
04:25 PM PT
@@ -106,12 +105,12 @@ sections: - type: markdown text: " - - + + + + - -
DetailsOriginating updateStatusHistory
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
-

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Next steps: At this time, we suggest that devices in an affected environment do not install KB4497935. We are working on a resolution and estimate a solution will be available in late August.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
KB4512941		Last updated:
August 13, 2019
06:59 PM PT

Opened:
July 25, 2019
06:10 PM PT
Issues updating when certain versions of Intel storage drivers are installed
Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Workaround: To mitigate this issue before the resolution is released, you will need to update the Intel RST drivers for your device to version 15.5.2.1054 or a later.  Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You can also download the latest Intel RST drivers directly from Intel at Intel® Rapid Storage Technology (Intel® RST) User Interface and Driver. Once your drivers are updated, you can restart the installation process for Windows 10, version 1903. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

Next Steps: We are working on a resolution and estimate a solution will be available in late August.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Mitigated External
Last updated:
August 09, 2019
07:03 PM PT

Opened:
July 25, 2019
06:10 PM PT
Issues updating when certain versions of Intel storage drivers are installed
Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Workaround: To mitigate this issue before the safeguard hold is removed, you will need to update the Intel RST drivers for your device to version 15.5.2.1054 or a later.  Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You can also download the latest Intel RST drivers directly from Intel at Intel® Rapid Storage Technology (Intel® RST) User Interface and Driver. Once your drivers are updated, you can restart the installation process for Windows 10, version 1903. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

Resolution: This issue was resolved in KB4512941. The safeguard hold is estimated to be removed in early September.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
Initiating a Remote Desktop connection may result in black screen
When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Resolution: This issue was resolved in KB4512941.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 12, 2019
04:42 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503293 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Resolution: This issue was resolved in KB4512941.

Back to top		OS Build 18362.175

June 11, 2019
KB4503293		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 10, 2019
02:51 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in KB4512941. The safeguard hold is estimated to be removed in early September.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
July 25, 2019
06:10 PM PT
The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU
Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing unit (dGPU). After updating to Windows 10, version 1903 (May 2019 Feature Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.

To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPUs from being offered Windows 10, version 1903, until this issue is resolved.

Affected platforms:
  • Client: Windows 10, version 1903
Workaround: To mitigate the issue if you are already on Windows 10, version 1903, you can restart the device or select the Scan for hardware changes button in the Action menu or on the toolbar in Device Manager.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Next steps: We are working on a resolution and will provide an update in an upcoming release.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
Last updated:
July 16, 2019
09:04 AM PT

Opened:
July 12, 2019
04:20 PM PT
Initiating a Remote Desktop connection may result in black screen
When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Next steps: We are working on a resolution that will be made available in upcoming release.

Back to top		OS Build 18362.145

May 29, 2019
KB4497935		Investigating
KB4512941		Last updated:
July 12, 2019
04:42 PM PT

Opened:
July 12, 2019
04:42 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503293 on a WDS server.

Affected platforms:
  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
Workaround:
To mitigate this issue on an SCCM server:
  1. Verify Variable Window Extension is enabled.
  2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

To mitigate this issue on a WDS server without SCCM:
  1. In WDS TFTP settings, verify Variable Window Extension is enabled.
  2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
  3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

Next steps: We are working on a resolution and will provide an update in an upcoming release.

Back to top		OS Build 18362.175

June 11, 2019
KB4503293		Mitigated
KB4512941		Last updated:
July 10, 2019
07:09 PM PT

Opened:
July 10, 2019
02:51 PM PT
" @@ -120,10 +119,9 @@ sections: - type: markdown text: " - + - diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index a69de08f66..2785208d7d 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,6 +50,8 @@ sections: text: "
DetailsOriginating updateStatusHistory
Windows Sandbox may fail to start with error code “0x80070002”
Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.

Affected platforms:
  • Client: Windows 10, version 1903
Next steps: We are working on a resolution and estimates a solution will be available in late August.

Back to top		OS Build 18362.116

May 20, 2019
KB4505057		Investigating
KB4512941		Last updated:
August 20, 2019
11:06 AM PT

Opened:
May 24, 2019
04:20 PM PT
Windows Sandbox may fail to start with error code “0x80070002”
Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: This issue was resolved in KB4512941.

Back to top		OS Build 18362.116

May 20, 2019
KB4505057		Resolved
KB4512941		Resolved:
August 30, 2019
10:00 AM PT

Opened:
May 24, 2019
04:20 PM PT
Intermittent loss of Wi-Fi connectivity
Some older computers may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

To safeguard your upgrade experience, we have applied a hold on devices with this Qualcomm driver from being offered Windows 10, version 1903, until the updated driver is installed.

Affected platforms:
  • Client: Windows 10, version 1903
Workaround: Before updating to Windows 10, version 1903, you will need to download and install an updated Wi-Fi driver from your device manufacturer (OEM).
 
Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.

Back to top		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated External
Last updated:
August 01, 2019
08:44 PM PT

Opened:
May 21, 2019
07:13 AM PT
Gamma ramps, color profiles, and night light settings do not apply in some cases
Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

Microsoft has identified some scenarios in which these features may have issues or stop working, for example:
  • Connecting to (or disconnecting from) an external monitor, dock, or projector
  • Rotating the screen
  • Updating display drivers or making other display mode changes
  • Closing full screen applications
  • Applying custom color profiles
  • Running applications that rely on custom gamma ramps
Affected platforms:
  • Client: Windows 10, version 1903
Workaround: If you find that your night light has stopped working, try turning the night light off and on, or restarting your computer. For other color setting issues, restart your computer to correct the issue.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Next steps: We are working on a resolution and will provide an update in an upcoming release.

Back to top		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated
Last updated:
August 01, 2019
06:27 PM PT

Opened:
May 21, 2019
07:28 AM PT
Display brightness may not respond to adjustments
Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Windows 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.

To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: This issue was resolved in KB4505903 and the safeguard hold has been removed. Please ensure you have applied the resolving update before attempting to update to the Windows 10 May 2019 Update (version 1903). Please note, it can take up to 48 hours for the safeguard to be removed.

Back to top		OS Build 18362.116

May 21, 2019
KB4505057		Resolved
KB4505903		Resolved:
July 26, 2019
02:00 PM PT

Opened:
May 21, 2019
07:56 AM PT
Unable to discover or connect to Bluetooth devices
Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek and Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek or Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: Windows Server, version 1903
Workaround: Check with your device manufacturer (OEM) to see if an updated driver is available and install it.

  • For Qualcomm drivers, you will need to install a driver version greater than 10.0.1.11.
  • For Realtek drivers, you will need to install a driver version greater than 1.5.1011.0.
Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

Next steps: Microsoft is working with Realtek and Qualcomm to release new drivers for all affected system via Windows Update.  


Back to top		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated
Last updated:
May 21, 2019
04:48 PM PT

Opened:
May 21, 2019
07:29 AM PT
Intel Audio displays an intcdaud.sys notification
Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).
  
To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.

Affected platforms:
  • Client: Windows 10, version 1903; Windows 10, version 1809
Workaround:
On the “What needs your attention\" notification, click the Back button to remain on your current version of Windows 10. (Do not click Confirm as this will proceed with the update and you may experience compatibility issues.) Affected devices will automatically revert to the previous working configuration.

For more information, see Intel's customer support guidance and the Microsoft knowledge base article KB4465877.

Note We recommend you do not attempt to update your devices until newer device drivers are installed.

Next steps: You can opt to wait for newer drivers to be installed automatically through Windows Update or check with the computer manufacturer for the latest device driver software availability and installation procedures.

Back to top		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated
Last updated:
May 21, 2019
04:47 PM PT

Opened:
May 21, 2019
07:22 AM PT
Cannot launch Camera app
Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:

\"Close other apps, error code: 0XA00F4243.”


To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.

Affected platforms:
  • Client: Windows 10, version 1903
Workaround: To temporarily resolve this issue, perform one of the following:

  • Unplug your camera and plug it back in.

or

  • Disable and re-enable the driver in Device Manager. In the Search box, type \"Device Manager\" and press Enter. In the Device Manager dialog box, expand Cameras, then right-click on any RealSense driver listed and select Disable device. Right click on the driver again and select Enable device.

or

  • Restart the RealSense service. In the Search box, type \"Task Manager\" and hit Enter. In the Task Manager dialog box, click on the Services tab, right-click on RealSense, and select Restart. 
Note This workaround will only resolve the issue until your next system restart.

Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

Next steps: We are working on a resolution and will provide an update in an upcoming release.

Back to top		OS Build 18362.116

May 21, 2019
KB4505057		Mitigated
Last updated:
May 21, 2019
04:47 PM PT

Opened:
May 21, 2019
07:20 AM PT
+ + diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index a245fe1b42..2783c5080d 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -398,7 +398,6 @@ ####### [Get domain related alerts](microsoft-defender-atp/get-domain-related-alerts.md) ####### [Get domain related machines](microsoft-defender-atp/get-domain-related-machines.md) ####### [Get domain statistics](microsoft-defender-atp/get-domain-statistics.md) -####### [Is domain seen in organization (Deprecated)](microsoft-defender-atp/is-domain-seen-in-org.md) ###### [File]() ####### [File methods and properties](microsoft-defender-atp/files.md) @@ -409,9 +408,7 @@ ###### [IP]() ####### [Get IP related alerts](microsoft-defender-atp/get-ip-related-alerts.md) -####### [Get IP related machines (Deprecated)](microsoft-defender-atp/get-ip-related-machines.md) ####### [Get IP statistics](microsoft-defender-atp/get-ip-statistics.md) -####### [Is IP seen in organization (Deprecated)](microsoft-defender-atp/is-ip-seen-org.md) ###### [User]() ####### [User methods](microsoft-defender-atp/user.md) @@ -440,13 +437,13 @@ ##### [Experiment with custom threat intelligence alerts (Deprecated)](microsoft-defender-atp/experiment-custom-ti.md) ##### [Troubleshoot custom threat intelligence issues (Deprecated)](microsoft-defender-atp/troubleshoot-custom-ti.md) -#### [Pull alerts to your SIEM tools]() -##### [Learn about different ways to pull alerts](microsoft-defender-atp/configure-siem.md) +#### [Pull detections to your SIEM tools]() +##### [Learn about different ways to pull detections](microsoft-defender-atp/configure-siem.md) ##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md) -##### [Configure Splunk to pull alerts](microsoft-defender-atp/configure-splunk.md) -##### [Configure HP ArcSight to pull alerts](microsoft-defender-atp/configure-arcsight.md) -##### [Microsoft Defender ATP SIEM alert API fields](microsoft-defender-atp/api-portal-mapping.md) -##### [Pull alerts using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md) +##### [Configure Splunk to pull detections](microsoft-defender-atp/configure-splunk.md) +##### [Configure HP ArcSight to pull detections](microsoft-defender-atp/configure-arcsight.md) +##### [Microsoft Defender ATP detection fields](microsoft-defender-atp/api-portal-mapping.md) +##### [Pull detections using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md) ##### [Troubleshoot SIEM tool integration issues](microsoft-defender-atp/troubleshoot-siem.md) #### [Reporting]() diff --git a/windows/security/threat-protection/images/TVM_icon.png b/windows/security/threat-protection/images/TVM_icon.png index 41faa16718..63f8c75929 100644 Binary files a/windows/security/threat-protection/images/TVM_icon.png and b/windows/security/threat-protection/images/TVM_icon.png differ diff --git a/windows/security/threat-protection/intelligence/images/Transparency-report-August-2.png b/windows/security/threat-protection/intelligence/images/Transparency-report-August-2.png new file mode 100644 index 0000000000..9769fd54cb Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/Transparency-report-August-2.png differ diff --git a/windows/security/threat-protection/intelligence/images/Transparency-report-August.png b/windows/security/threat-protection/intelligence/images/Transparency-report-August.png deleted file mode 100644 index 451b3dfb4a..0000000000 Binary files a/windows/security/threat-protection/intelligence/images/Transparency-report-August.png and /dev/null differ diff --git a/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md b/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md index 7b67e93b21..a7390ce9d0 100644 --- a/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md +++ b/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md @@ -26,7 +26,7 @@ Microsoft Defender Advanced Threat Protection ([Microsoft Defender ATP](https:// Windows Defender Antivirus is the [next generation protection](https://www.youtube.com/watch?v=Xy3MOxkX_o4) capability in the Microsoft Defender ATP security stack which addresses the latest and most sophisticated threats today. In some cases, customers might not even know they were protected because a cyberattack is stopped [milliseconds after a campaign starts](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign?ocid=cx-docs-avreports). That's because Windows Defender Antivirus detects and stops malware at first sight by using [machine learning](https://cloudblogs.microsoft.com/microsoftsecure/2018/06/07/machine-learning-vs-social-engineering?ocid=cx-docs-avreports), [artificial intelligence](https://cloudblogs.microsoft.com/microsoftsecure/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak?ocid=cx-docs-avreports), behavioral analysis, and other advanced technologies.

-![String of images showing scores](./images/Transparency-report-August.png) +![String of images showing scores](./images/Transparency-report-August-2.png) **Download the latest transparency report: [Examining industry test results, August 2019](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl)** @@ -48,10 +48,6 @@ The AV-TEST Product Review and Certification Report tests on three categories: p - July - August 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/august-2018/microsoft-windows-defender-antivirus-4.12--4.18-183212/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2IL3Y) -||| -|---|---| -|![Graph showing Microsoft's Real-World detection rate scores for AV-Test](./images/real-world-aug-small.png)|![Graph showing Microsoft's Prevalent Malware detection rate scores for AV-Test](./images/prevalent-malware-aug-small.png)| - ### AV-Comparatives: Protection rating of 99.9% in the latest test Business Security Test consists of three main parts: the Real-World Protection Test which mimics online malware attacks, the Malware Protection Test where the malware enters the system from outside the internet (e.g. USB), and the Performance Test which looks at the impact on the system’s performance. @@ -64,9 +60,7 @@ Business Security Test consists of three main parts: the Real-World Protection T - Business Security Test 2018 (March - June): [Real-World Protection Rate 98.7%](https://www.av-comparatives.org/tests/business-security-test-2018-march-june/) -![Graph showing Microsoft's Real-World Protection scores for AV-Comparatives](./images/real-world-protection-aug-small.png) - -### SE Labs: Total accuracy rating of AAA in the latest test +### SE Labs: AAA award in the latest test SE Labs tests a range of solutions used by products and services to detect and/or protect against attacks, including endpoint software, network appliances, and cloud services. diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md index 9706e81443..ef351af05d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md @@ -1,7 +1,7 @@ --- -title: Microsoft Defender ATP alert API fields -description: Understand how the alert API fields map to the values in Microsoft Defender Security Center -keywords: alerts, alert fields, fields, api, fields, pull alerts, rest api, request, response +title: Microsoft Defender ATP detections API fields +description: Understand how the Detections API fields map to the values in Microsoft Defender Security Center +keywords: detections, detections fields, fields, api, fields, pull Detections, rest api, request, response search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -15,10 +15,9 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/16/2017 --- -# Microsoft Defender ATP SIEM alert API fields +# Microsoft Defender ATP detections API fields **Applies to:** @@ -26,10 +25,14 @@ ms.date: 10/16/2017 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink) -Understand what data fields are exposed as part of the alerts API and how they map to Microsoft Defender Security Center. +Understand what data fields are exposed as part of the detections API and how they map to Microsoft Defender Security Center. -## Alert API fields and portal mapping -The following table lists the available fields exposed in the alerts API payload. It shows examples for the populated values and a reference on how data is reflected on the portal. +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- **Microsoft Defender ATP Detection** is composed from the suspicious event occurred on the Machine and its related **Alert** details. + +## Detections API fields and portal mapping +The following table lists the available fields exposed in the detections API payload. It shows examples for the populated values and a reference on how data is reflected on the portal. The ArcSight field column contains the default mapping between the Microsoft Defender ATP fields and the built-in fields in ArcSight. You can download the mapping file from the portal when you enable the SIEM integration feature and you can modify it to match the needs of your organization. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md). @@ -39,33 +42,33 @@ Field numbers match the numbers in the images below. > > | Portal label | SIEM field name | ArcSight field | Example value | Description | > |------------------|---------------------------|---------------------|------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -> | 1 | AlertTitle | name | Windows Defender AV detected 'Mikatz' high-severity malware | Value available for every alert. | -> | 2 | Severity | deviceSeverity | High | Value available for every alert. | -> | 3 | Category | deviceEventCategory | Malware | Value available for every alert. | -> | 4 | Detection source | sourceServiceName | Antivirus | Windows Defender Antivirus or Microsoft Defender ATP. Value available for every alert. | -> | 5 | MachineName | sourceHostName | desktop-4a5ngd6 | Value available for every alert. | -> | 6 | FileName | fileName | Robocopy.exe | Available for alerts associated with a file or process. | -> | 7 | FilePath | filePath | C:\Windows\System32\Robocopy.exe | Available for alerts associated with a file or process. | -> | 8 | UserDomain | sourceNtDomain | CONTOSO | The domain of the user context running the activity, available for Microsoft Defender ATP behavioral based alerts. | -> | 9 | UserName | sourceUserName | liz.bean | The user context running the activity, available for Microsoft Defender ATP behavioral based alerts. | -> | 10 | Sha1 | fileHash | 3da065e07b990034e9db7842167f70b63aa5329 | Available for alerts associated with a file or process. | -> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Windows Defender AV alerts. | -> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Windows Defender AV alerts. | -> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Windows Defender AV alerts. | -> | 14 | IpAddress | sourceAddress | 218.90.204.141 | Available for alerts associated to network events. For example, 'Communication to a malicious network destination'. | -> | 15 | Url | requestUrl | down.esales360.cn | Available for alerts associated to network events. For example, 'Communication to a malicious network destination'. | -> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE. | -> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE. | -> | 18 | AlertId | externalId | 636210704265059241_673569822 | Value available for every alert. | -> | 19 | LinkToWDATP | flexString1 | `https://securitycenter.windows.com/alert/636210704265059241_673569822` | Value available for every alert. | -> | 20 | AlertTime | deviceReceiptTime | 2017-05-07T01:56:59.3191352Z | The time the activity relevant to the alert occurred. Value available for every alert. | -> | 21 | MachineDomain | sourceDnsDomain | contoso.com | Domain name not relevant for AAD joined machines. Value available for every alert. | +> | 1 | AlertTitle | name | Windows Defender AV detected 'Mikatz' high-severity malware | Value available for every Detection. | +> | 2 | Severity | deviceSeverity | High | Value available for every Detection. | +> | 3 | Category | deviceEventCategory | Malware | Value available for every Detection. | +> | 4 | Detection source | sourceServiceName | Antivirus | Windows Defender Antivirus or Microsoft Defender ATP. Value available for every Detection. | +> | 5 | MachineName | sourceHostName | desktop-4a5ngd6 | Value available for every Detection. | +> | 6 | FileName | fileName | Robocopy.exe | Available for detections associated with a file or process. | +> | 7 | FilePath | filePath | C:\Windows\System32\Robocopy.exe | Available for detections associated with a file or process. | +> | 8 | UserDomain | sourceNtDomain | CONTOSO | The domain of the user context running the activity, available for Microsoft Defender ATP behavioral based detections. | +> | 9 | UserName | sourceUserName | liz.bean | The user context running the activity, available for Microsoft Defender ATP behavioral based detections. | +> | 10 | Sha1 | fileHash | 3da065e07b990034e9db7842167f70b63aa5329 | Available for detections associated with a file or process. | +> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Windows Defender AV detections. | +> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Windows Defender AV detections. | +> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Windows Defender AV detections. | +> | 14 | IpAddress | sourceAddress | 218.90.204.141 | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. | +> | 15 | Url | requestUrl | down.esales360.cn | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. | +> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | +> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | +> | 18 | AlertId | externalId | 636210704265059241_673569822 | Value available for every Detection. | +> | 19 | LinkToWDATP | flexString1 | `https://securitycenter.windows.com/alert/636210704265059241_673569822` | Value available for every Detection. | +> | 20 | AlertTime | deviceReceiptTime | 2017-05-07T01:56:59.3191352Z | The time the event occurred. Value available for every Detection. | +> | 21 | MachineDomain | sourceDnsDomain | contoso.com | Domain name not relevant for AAD joined machines. Value available for every Detection. | > | 22 | Actor | deviceCustomString4 | BORON | Available for alerts related to a known actor group. | -> | 21+5 | ComputerDnsName | No mapping | liz-bean.contoso.com | The machine fully qualified domain name. Value available for every alert. | +> | 21+5 | ComputerDnsName | No mapping | liz-bean.contoso.com | The machine fully qualified domain name. Value available for every Detection. | > | | LogOnUsers | sourceUserId | contoso\liz-bean; contoso\jay-hardee | The domain and user of the interactive logon user/s at the time of the event. Note: For machines on Windows 10 version 1607, the domain information will not be available. | > | | InternalIPv4List | No mapping | 192.168.1.7, 10.1.14.1 | List of IPV4 internal IPs for active network interfaces. | > | | InternalIPv6List | No mapping | fd30:0000:0000:0001:ff4e:003e:0009:000e, FE80:CD00:0000:0CDE:1257:0000:211E:729C | List of IPV6 internal IPs for active network interfaces. | -> | Internal field | LastProcessedTimeUtc | No mapping | 2017-05-07T01:56:58.9936648Z | Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that alerts are retrieved. | +> | Internal field | LastProcessedTimeUtc | No mapping | 2017-05-07T01:56:58.9936648Z | Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that detections are retrieved. | > | | Not part of the schema | deviceVendor | | Static value in the ArcSight mapping - 'Microsoft'. | > | | Not part of the schema | deviceProduct | | Static value in the ArcSight mapping - 'Microsoft Defender ATP'. | > | | Not part of the schema | deviceVersion | | Static value in the ArcSight mapping - '2.0', used to identify the mapping versions. @@ -88,7 +91,7 @@ Field numbers match the numbers in the images below. ## Related topics - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) -- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) -- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) +- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) +- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) +- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md b/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md index 22c9359f44..736e5fc809 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md @@ -1,6 +1,6 @@ --- -title: Configure HP ArcSight to pull Microsoft Defender ATP alerts -description: Configure HP ArcSight to receive and pull alerts from Microsoft Defender Security Center +title: Configure HP ArcSight to pull Microsoft Defender ATP detections +description: Configure HP ArcSight to receive and pull detections from Microsoft Defender Security Center keywords: configure hp arcsight, security information and events management tools, arcsight search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -15,10 +15,9 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/20/2018 --- -# Configure HP ArcSight to pull Microsoft Defender ATP alerts +# Configure HP ArcSight to pull Microsoft Defender ATP detections **Applies to:** @@ -29,10 +28,14 @@ ms.date: 12/20/2018 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink) -You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Microsoft Defender ATP alerts. +You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Microsoft Defender ATP detections. + +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. ## Before you begin -Configuring the HP ArcSight Connector tool requires several configuration files for it to pull and parse alerts from your Azure Active Directory (AAD) application. +Configuring the HP ArcSight Connector tool requires several configuration files for it to pull and parse detections from your Azure Active Directory (AAD) application. This section guides you in getting the necessary information to set and use the required configuration files correctly. @@ -163,7 +166,7 @@ The following steps assume that you have completed all the required steps in [Be You can now run queries in the HP ArcSight console. -Microsoft Defender ATP alerts will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name. +Microsoft Defender ATP detections will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name. ## Troubleshooting HP ArcSight connection @@ -187,6 +190,6 @@ Microsoft Defender ATP alerts will appear as discrete events, with "Microsoft” ## Related topics - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) -- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) +- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) +- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md b/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md index c5e8719018..89fb09887a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md @@ -1,6 +1,6 @@ --- -title: Pull alerts to your SIEM tools from Microsoft Defender Advanced Threat Protection -description: Learn how to use REST API and configure supported security information and events management tools to receive and pull alerts. +title: Pull detections to your SIEM tools from Microsoft Defender Advanced Threat Protection +description: Learn how to use REST API and configure supported security information and events management tools to receive and pull detections. keywords: configure siem, security information and events management tools, splunk, arcsight, custom indicators, rest api, alert definitions, indicators of compromise search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/16/2017 --- -# Pull alerts to your SIEM tools +# Pull detections to your SIEM tools **Applies to:** @@ -26,8 +26,13 @@ ms.date: 10/16/2017 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) -## Pull alerts using security information and events management (SIEM) tools -Microsoft Defender ATP supports (SIEM) tools to pull alerts. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment. +## Pull detections using security information and events management (SIEM) tools + +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. + +Microsoft Defender ATP supports (SIEM) tools to pull detections. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull detections from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment. Microsoft Defender ATP currently supports the following SIEM tools: @@ -39,16 +44,16 @@ To use either of these supported SIEM tools you'll need to: - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) - Configure the supported SIEM tool: - - [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) - - [Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) + - [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) + - [Configure HP ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) -For more information on the list of fields exposed in the alerts API see, [Microsoft Defender ATP alert API fields](api-portal-mapping.md). +For more information on the list of fields exposed in the Detection API see, [Microsoft Defender ATP Detection fields](api-portal-mapping.md). -## Pull Microsoft Defender ATP alerts using REST API -Microsoft Defender ATP supports the OAuth 2.0 protocol to pull alerts using REST API. +## Pull Microsoft Defender ATP detections using REST API +Microsoft Defender ATP supports the OAuth 2.0 protocol to pull detections using REST API. -For more information, see [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md). +For more information, see [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md). ## In this section @@ -56,8 +61,8 @@ For more information, see [Pull Microsoft Defender ATP alerts using REST API](pu Topic | Description :---|:--- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)| Learn about enabling the SIEM integration feature in the **Settings** page in the portal so that you can use and generate the required information to configure supported SIEM tools. -[Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)| Learn about installing the REST API Modular Input app and other configuration settings to enable Splunk to pull Microsoft Defender ATP alerts. -[Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)| Learn about installing the HP ArcSight REST FlexConnector package and the files you need to configure ArcSight to pull Microsoft Defender ATP alerts. -[Microsoft Defender ATP alert API fields](api-portal-mapping.md) | Understand what data fields are exposed as part of the alerts API and how they map to Microsoft Defender Security Center. -[Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) | Use the Client credentials OAuth 2.0 flow to pull alerts from Microsoft Defender ATP using REST API. +[Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md)| Learn about installing the REST API Modular Input App and other configuration settings to enable Splunk to pull Microsoft Defender ATP detections. +[Configure HP ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md)| Learn about installing the HP ArcSight REST FlexConnector package and the files you need to configure ArcSight to pull Microsoft Defender ATP detections. +[Microsoft Defender ATP Detection fields](api-portal-mapping.md) | Understand what data fields are exposed as part of the alerts API and how they map to Microsoft Defender Security Center. +[Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) | Use the Client credentials OAuth 2.0 flow to pull detections from Microsoft Defender ATP using REST API. [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) | Address issues you might encounter when using the SIEM integration feature. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md b/windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md index 13cf662e66..6d0db578d1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md @@ -1,6 +1,6 @@ --- -title: Configure Splunk to pull Microsoft Defender ATP alerts -description: Configure Splunk to receive and pull alerts from Microsoft Defender Security Center. +title: Configure Splunk to pull Microsoft Defender ATP detections +description: Configure Splunk to receive and pull detections from Microsoft Defender Security Center. keywords: configure splunk, security information and events management tools, splunk search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Configure Splunk to pull Microsoft Defender ATP alerts +# Configure Splunk to pull Microsoft Defender ATP detections **Applies to:** @@ -28,7 +28,11 @@ ms.topic: article >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresplunk-abovefoldlink) -You'll need to configure Splunk so that it can pull Microsoft Defender ATP alerts. +You'll need to configure Splunk so that it can pull Microsoft Defender ATP detections. + +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. ## Before you begin @@ -121,8 +125,8 @@ You'll need to configure Splunk so that it can pull Microsoft Defender ATP alert After completing these configuration steps, you can go to the Splunk dashboard and run queries. -## View alerts using Splunk solution explorer -Use the solution explorer to view alerts in Splunk. +## View detections using Splunk solution explorer +Use the solution explorer to view detections in Splunk. 1. In Splunk, go to **Settings** > **Searchers, reports, and alerts**. @@ -141,12 +145,12 @@ Use the solution explorer to view alerts in Splunk. >[!TIP] -> To mininimize alert duplications, you can use the following query: +> To mininimize Detection duplications, you can use the following query: >```source="rest://windows atp alerts" | spath | dedup _raw | table *``` ## Related topics - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) -- [Microsoft Defender ATP alert API fields](api-portal-mapping.md) -- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) +- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) +- [Microsoft Defender ATP Detection fields](api-portal-mapping.md) +- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md b/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md index 2c9fa62654..707f89cea2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md @@ -1,6 +1,6 @@ --- title: Enable SIEM integration in Microsoft Defender ATP -description: Enable SIEM integration to receive alerts in your security information and event management (SIEM) solution. +description: Enable SIEM integration to receive detections in your security information and event management (SIEM) solution. keywords: enable siem connector, siem, connector, security information and events search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/10/2018 --- # Enable SIEM integration in Microsoft Defender ATP @@ -26,7 +25,11 @@ ms.date: 12/10/2018 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-enablesiem-abovefoldlink) -Enable security information and event management (SIEM) integration so you can pull alerts from Microsoft Defender Security Center using your SIEM solution or by connecting directly to the alerts REST API. +Enable security information and event management (SIEM) integration so you can pull detections from Microsoft Defender Security Center using your SIEM solution or by connecting directly to the detections REST API. + +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. ## Prerequisites - The user who activates the setting must have permissions to create an app in Azure Active Directory (AAD). This is typically someone with a **Global administrator** role. @@ -55,7 +58,7 @@ Enable security information and event management (SIEM) integration so you can p > - WDATP-connector.jsonparser.properties > - WDATP-connector.properties
- If you want to connect directly to the alerts REST API through programmatic access, choose **Generic API**. + If you want to connect directly to the detections REST API through programmatic access, choose **Generic API**. 4. Copy the individual values or select **Save details to file** to download a file that contains all the values. @@ -64,14 +67,14 @@ Enable security information and event management (SIEM) integration so you can p > [!NOTE] > You'll need to generate a new Refresh token every 90 days. -You can now proceed with configuring your SIEM solution or connecting to the alerts REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive alerts from Microsoft Defender Security Center. +You can now proceed with configuring your SIEM solution or connecting to the detections REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive detections from Microsoft Defender Security Center. ## Integrate Microsoft Defender ATP with IBM QRadar -You can configure IBM QRadar to collect alerts from Microsoft Defender ATP. For more information, see [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/c_dsm_guide_MS_Win_Defender_ATP_overview.html?cp=SS42VS_7.3.1). +You can configure IBM QRadar to collect detections from Microsoft Defender ATP. For more information, see [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/c_dsm_guide_MS_Win_Defender_ATP_overview.html?cp=SS42VS_7.3.1). ## Related topics -- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) -- [Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) -- [Microsoft Defender ATP alert API fields](api-portal-mapping.md) -- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) +- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) +- [Configure HP ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) +- [Microsoft Defender ATP Detection fields](api-portal-mapping.md) +- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines.md b/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines.md deleted file mode 100644 index c247c9aa81..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -title: Get IP related machines API -description: Retrieves a collection of machines related to a given IP address. -keywords: apis, graph api, supported apis, get, ip, related, machines -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Get IP related machines API (Deprecated) - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Retrieves a collection of machines that communicated with or from a particular IP. - -## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) - -Permission type | Permission | Permission display name -:---|:---|:--- -Application | Machine.Read.All | 'Read all machine profiles' -Application | Machine.ReadWrite.All | 'Read and write all machine information' -Delegated (work or school account) | Machine.Read | 'Read machine information' -Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' - ->[!Note] -> When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information) ->- Response will include only machines, that the user have access to, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information) - -## HTTP request -``` -GET /api/ips/{ip}/machines -``` - -## Request headers - -Name | Type | Description -:---|:---|:--- -Authorization | String | Bearer {token}. **Required**. - - -## Request body -Empty - -## Response -If successful and IP exists - 200 OK with list of [machine](machine.md) entities in the body. If IP do not exist - 404 Not Found. - - -## Example - -**Request** - -Here is an example of the request. - -[!include[Improve request performance](improve-request-performance.md)] - -``` -GET https://api.securitycenter.windows.com/api/ips/10.209.67.177/machines -``` - -**Response** - -Here is an example of the response. - - -``` -HTTP/1.1 200 OK -Content-type: application/json -{ - "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", - "value": [ - { - "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", - "computerDnsName": "mymachine1.contoso.com", - "firstSeen": "2018-08-02T14:55:03.7791856Z", - "lastSeen": "2018-08-02T14:55:03.7791856Z", - "osPlatform": "Windows10", - "osVersion": "10.0.0.0", - "lastIpAddress": "172.17.230.209", - "lastExternalIpAddress": "167.220.196.71", - "agentVersion": "10.5830.18209.1001", - "osBuild": 18209, - "healthStatus": "Active", - "rbacGroupId": 140, - "riskScore": "Low", - "rbacGroupName": "The-A-Team", - "aadDeviceId": "80fe8ff8-2624-418e-9591-41f0491218f9", - "machineTags": [ "test tag 1", "test tag 2" ] - }, - { - "id": "7292e4b8cb74ff1cc3d8a495eb29dc8858b732f7", - "computerDnsName": "mymachine2.contoso.com", - "firstSeen": "2018-07-09T13:22:45.1250071Z", - "lastSeen": "2018-07-09T13:22:45.1250071Z", - "osPlatform": "Windows10", - "osVersion": "10.0.0.0", - "lastIpAddress": "192.168.12.225", - "lastExternalIpAddress": "79.183.65.82", - "agentVersion": "10.5820.17724.1000", - "osBuild": 17724, - "healthStatus": "Inactive", - "rbacGroupId": 140, - "rbacGroupName": "The-A-Team", - "riskScore": "Low", - "aadDeviceId": null, - "machineTags": [ "test tag 1" ] - } - ] -} -``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machine_page_flyout.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machine_page_flyout.png new file mode 100644 index 0000000000..7d83e1545d Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machine_page_flyout.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machines_discoveredvuln.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machines_discoveredvuln.png new file mode 100644 index 0000000000..08e0e2f831 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machines_discoveredvuln.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machineslist.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machineslist.png new file mode 100644 index 0000000000..ea9e800b94 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machineslist.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machinetoinvestigate.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machinetoinvestigate.png new file mode 100644 index 0000000000..864dff2f13 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machinetoinvestigate.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy.png new file mode 100644 index 0000000000..4b1c91c9e4 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_software.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_software.png new file mode 100644 index 0000000000..6589185f64 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_software.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwarecolon.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwarecolon.png new file mode 100644 index 0000000000..eb0c4314c7 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwarecolon.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareflyout.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareflyout.png new file mode 100644 index 0000000000..0b72121e67 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareflyout.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareoptions.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareoptions.png new file mode 100644 index 0000000000..8f61d18462 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareoptions.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vuln.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vuln.png new file mode 100644 index 0000000000..08c0a00cc9 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vuln.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnflyout.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnflyout.png new file mode 100644 index 0000000000..cae0239957 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnflyout.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnoptions.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnoptions.png new file mode 100644 index 0000000000..cf9f274980 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnoptions.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyflyout.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyflyout.png new file mode 100644 index 0000000000..9af2ad6945 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyflyout.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyoptions.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyoptions.png new file mode 100644 index 0000000000..09c4876e1d Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyoptions.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_weaknesses_machinepage.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_weaknesses_machinepage.png new file mode 100644 index 0000000000..5c56b70612 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_weaknesses_machinepage.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md b/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md deleted file mode 100644 index 38debbe291..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Is domain seen in org API -description: Use this API to create calls related to checking whether a domain was seen in the organization. -keywords: apis, graph api, supported apis, domain, domain seen -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Was domain seen in org (Deprecated) - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Answers whether a domain was seen in the organization. - -## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) - -Permission type | Permission | Permission display name -:---|:---|:--- -Application | Url.Read.All | 'Read URLs' -Delegated (work or school account) | URL.Read.All | 'Read URLs' - ->[!Note] -> When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information) - -## HTTP request -``` -GET /api/domains/{domain} -``` - -## Request headers - -Header | Value -:---|:--- -Authorization | Bearer {token}. **Required**. - - -## Request body -Empty - -## Response -If successful and domain exists - 200 OK. If domain does not exist - 404 Not Found. - -## Example - -**Request** - -Here is an example of the request. - -[!include[Improve request performance](improve-request-performance.md)] - -``` -GET https://api.securitycenter.windows.com/api/domains/example.com -Content-type: application/json -``` - -**Response** - -Here is an example of the response. - - -``` -HTTP/1.1 200 OK -Content-type: application/json -{ - "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Domains/$entity", - "host": "example.com" -} -``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org.md b/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org.md deleted file mode 100644 index f112796be2..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Is IP seen in org API -description: Answers whether an IP was seen in the organization. -keywords: apis, graph api, supported apis, is, ip, seen, org, organization -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Was IP seen in org (Deprecated) - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Answers whether an IP was seen in the organization. - -## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) - -Permission type | Permission | Permission display name -:---|:---|:--- -Application | Ip.Read.All | 'Read IP address profiles' -Delegated (work or school account) | Ip.Read.All | 'Read IP address profiles' - ->[!Note] -> When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information) - -## HTTP request -``` -GET /api/ips/{ip} -``` - -## Request headers - -Name | Type | Description -:---|:---|:--- -Authorization | String | Bearer {token}. **Required**. - - -## Request body -Empty - -## Response -If successful and IP exists - 200 OK. If IP do not exist - 404 Not Found. - - -## Example - -**Request** - -Here is an example of the request. - -``` -GET https://api.securitycenter.windows.com/api/ips/10.209.67.177 -``` - -**Response** - -Here is an example of the response. - -[!include[Improve request performance](improve-request-performance.md)] - - -``` -HTTP/1.1 200 OK -Content-type: application/json -{ - "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Ips/$entity", - "id": "10.209.67.177" -} -``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/management-apis.md b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md index 75f1890d2a..40c4a73464 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/management-apis.md +++ b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md @@ -52,7 +52,6 @@ An important aspect of machine management is the ability to analyze the environm Topic | Description :---|:--- Understand threat intelligence concepts | Learn about alert definitions, indicators of compromise, and other threat intelligence concepts. -Supported Microsoft Defender ATP APIs | Learn more about the individual supported entities where you can run API calls to and details such as HTTP request values, request headers and expected responses. Managed security service provider | Get a quick overview on managed security service provider support. diff --git a/windows/security/threat-protection/microsoft-defender-atp/oldTOC.txt b/windows/security/threat-protection/microsoft-defender-atp/oldTOC.txt index f06995f573..9dd1998f62 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/oldTOC.txt +++ b/windows/security/threat-protection/microsoft-defender-atp/oldTOC.txt @@ -392,7 +392,6 @@ ####### [Get domain related alerts](get-domain-related-alerts.md) ####### [Get domain related machines](get-domain-related-machines.md) ####### [Get domain statistics](get-domain-statistics.md) -####### [Is domain seen in organization (Deprecated)](is-domain-seen-in-org.md) ###### [File]() ####### [Methods and properties](files.md) @@ -403,9 +402,7 @@ ###### [IP]() ####### [Get IP related alerts](get-ip-related-alerts.md) -####### [Get IP related machines (Deprecated)](get-ip-related-machines.md) ####### [Get IP statistics](get-ip-statistics.md) -####### [Is IP seen in organization (Deprecated)](is-ip-seen-org.md) ###### [User]() ####### [Methods](user.md) @@ -428,13 +425,13 @@ ##### [Experiment with custom threat intelligence alerts](experiment-custom-ti.md) ##### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti.md) -#### [Pull alerts to your SIEM tools]() -##### [Learn about different ways to pull alerts](configure-siem.md) +#### [Pull Detections to your SIEM tools]() +##### [Learn about different ways to pull Detections](configure-siem.md) ##### [Enable SIEM integration](enable-siem-integration.md) -##### [Configure Splunk to pull alerts](configure-splunk.md) -##### [Configure HP ArcSight to pull alerts](configure-arcsight.md) -##### [Microsoft Defender ATP SIEM alert API fields](api-portal-mapping.md) -##### [Pull alerts using SIEM REST API](pull-alerts-using-rest-api.md) +##### [Configure Splunk to pull Detections](configure-splunk.md) +##### [Configure HP ArcSight to pull Detections](configure-arcsight.md) +##### [Microsoft Defender ATP Detection fields](api-portal-mapping.md) +##### [Pull Detections using SIEM REST API](pull-alerts-using-rest-api.md) ##### [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) #### [Reporting]() diff --git a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md index abf6c2fb00..c8bd39a230 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md @@ -1,7 +1,7 @@ --- -title: Pull Microsoft Defender ATP alerts using REST API -description: Pull alerts from Microsoft Defender ATP REST API. -keywords: alerts, pull alerts, rest api, request, response +title: Pull Microsoft Defender ATP detections using REST API +description: Pull detections from Microsoft Defender ATP REST API. +keywords: detections, pull detections, rest api, request, response search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Pull Microsoft Defender ATP alerts using SIEM REST API +# Pull Microsoft Defender ATP detections using SIEM REST API **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -26,7 +26,11 @@ ms.topic: article >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-pullalerts-abovefoldlink) -Microsoft Defender ATP supports the OAuth 2.0 protocol to pull alerts from the portal. +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. + +Microsoft Defender ATP supports the OAuth 2.0 protocol to pull detections from the API. In general, the OAuth 2.0 protocol supports four types of flows: - Authorization grant flow @@ -36,19 +40,19 @@ In general, the OAuth 2.0 protocol supports four types of flows: For more information about the OAuth specifications, see the [OAuth Website](http://www.oauth.net). -Microsoft Defender ATP supports the _Authorization grant flow_ and _Client credential flow_ to obtain access to generate alerts from the portal, with Azure Active Directory (AAD) as the authorization server. +Microsoft Defender ATP supports the _Authorization grant flow_ and _Client credential flow_ to obtain access to pull detections, with Azure Active Directory (AAD) as the authorization server. The _Authorization grant flow_ uses user credentials to get an authorization code, which is then used to obtain an access token. The _Client credential flow_ uses client credentials to authenticate against the Microsoft Defender ATP endpoint URL. This flow is suitable for scenarios when an OAuth client creates requests to an API that doesn't require user credentials. -Use the following method in the Microsoft Defender ATP API to pull alerts in JSON format. +Use the following method in the Microsoft Defender ATP API to pull detections in JSON format. >[!NOTE] >Microsoft Defender Security Center merges similar alert detections into a single alert. This API pulls alert detections in its raw form based on the query parameters you set, enabling you to apply your own grouping and filtering. ## Before you begin -- Before calling the Microsoft Defender ATP endpoint to pull alerts, you'll need to enable the SIEM integration application in Azure Active Directory (AAD). For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md). +- Before calling the Microsoft Defender ATP endpoint to pull detections, you'll need to enable the SIEM integration application in Azure Active Directory (AAD). For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md). - Take note of the following values in your Azure application registration. You need these values to configure the OAuth flow in your service or daemon app: - Application ID (unique to your application) @@ -59,7 +63,7 @@ Use the following method in the Microsoft Defender ATP API to pull alerts in JSO ## Get an access token Before creating calls to the endpoint, you'll need to get an access token. -You'll use the access token to access the protected resource, which are alerts in Microsoft Defender ATP. +You'll use the access token to access the protected resource, which are detections in Microsoft Defender ATP. To get an access token, you'll need to do a POST request to the token issuing endpoint. Here is a sample request: @@ -105,23 +109,23 @@ Use optional query parameters to specify and control the amount of data returned Name | Value| Description :---|:---|:--- -DateTime?sinceTimeUtc | string | Defines the lower time bound alerts are retrieved from, based on field:
`LastProcessedTimeUtc`
The time range will be: from sinceTimeUtc time to current time.

**NOTE**: When not specified, all alerts generated in the last two hours are retrieved. -DateTime?untilTimeUtc | string | Defines the upper time bound alerts are retrieved.
The time range will be: from `sinceTimeUtc` time to `untilTimeUtc` time.

**NOTE**: When not specified, the default value will be the current time. -string ago | string | Pulls alerts in the following time range: from `(current_time - ago)` time to `current_time` time.

Value should be set according to **ISO 8601** duration format
E.g. `ago=PT10M` will pull alerts received in the last 10 minutes. -int?limit | int | Defines the number of alerts to be retrieved. Most recent alerts will be retrieved based on the number defined.

**NOTE**: When not specified, all alerts available in the time range will be retrieved. -machinegroups | String | Specifies machine groups to pull alerts from.

**NOTE**: When not specified, alerts from all machine groups will be retrieved.

Example:

```https://wdatp-alertexporter-eu.securitycenter.windows.com/api/Alerts/?machinegroups=UKMachines&machinegroups=FranceMachines``` +DateTime?sinceTimeUtc | string | Defines the lower time bound detections are retrieved from, based on field:
`LastProcessedTimeUtc`
The time range will be: from sinceTimeUtc time to current time.

**NOTE**: When not specified, all detections generated in the last two hours are retrieved. +DateTime?untilTimeUtc | string | Defines the upper time bound detections are retrieved.
The time range will be: from `sinceTimeUtc` time to `untilTimeUtc` time.

**NOTE**: When not specified, the default value will be the current time. +string ago | string | Pulls detections in the following time range: from `(current_time - ago)` time to `current_time` time.

Value should be set according to **ISO 8601** duration format
E.g. `ago=PT10M` will pull detections received in the last 10 minutes. +int?limit | int | Defines the number of detections to be retrieved. Most recent detections will be retrieved based on the number defined.

**NOTE**: When not specified, all detections available in the time range will be retrieved. +machinegroups | String | Specifies machine groups to pull detections from.

**NOTE**: When not specified, detections from all machine groups will be retrieved.

Example:

```https://wdatp-alertexporter-eu.securitycenter.windows.com/api/Alerts/?machinegroups=UKMachines&machinegroups=FranceMachines``` DeviceCreatedMachineTags | string | Single machine tag from the registry. CloudCreatedMachineTags | string | Machine tags that were created in Microsoft Defender Security Center. ### Request example -The following example demonstrates how to retrieve all the alerts in your organization. +The following example demonstrates how to retrieve all the detections in your organization. ```syntax GET https://wdatp-alertexporter-eu.windows.com/api/alerts Authorization: Bearer ``` -The following example demonstrates a request to get the last 20 alerts since 2016-09-12 00:00:00. +The following example demonstrates a request to get the last 20 detections since 2016-09-12 00:00:00. ```syntax GET https://wdatp-alertexporter-eu.windows.com/api/alerts?limit=20&sinceTimeUtc=2016-09-12T00:00:00.000 @@ -178,14 +182,14 @@ AuthenticationContext context = new AuthenticationContext(string.Format("https:/ ClientCredential clientCredentials = new ClientCredential(clientId, clientSecret); AuthenticationResult authenticationResult = context.AcquireToken(resource, clientCredentials); ``` -### Use token to connect to the alerts endpoint +### Use token to connect to the detections endpoint ``` HttpClient httpClient = new HttpClient(); httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(authenticationResult.AccessTokenType, authenticationResult.AccessToken); HttpResponseMessage response = httpClient.GetAsync("https://wdatp-alertexporter-eu.windows.com/api/alert").GetAwaiter().GetResult(); -string alertsJson = response.Content.ReadAsStringAsync().Result; -Console.WriteLine("Got alert list: {0}", alertsJson); +string detectionsJson = response.Content.ReadAsStringAsync().Result; +Console.WriteLine("Got detections list: {0}", detectionsJson); ``` @@ -203,7 +207,7 @@ HTTP error code | Description ## Related topics - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) -- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) -- [Microsoft Defender ATP alert API fields](api-portal-mapping.md) +- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) +- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) +- [Microsoft Defender ATP Detection fields](api-portal-mapping.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md index d9cfb97c3f..a6aefcacdf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md @@ -188,3 +188,4 @@ All other related details are also shown, for example, submission date/time, sub ## Related topic - [Take response actions on a file](respond-file-alerts.md) +- [Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md index c45bc362d2..e6d27968c0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md @@ -25,7 +25,7 @@ ms.topic: troubleshooting -You might need to troubleshoot issues while pulling alerts in your SIEM tools. +You might need to troubleshoot issues while pulling detections in your SIEM tools. This page provides detailed steps to troubleshoot issues you might encounter. @@ -80,7 +80,7 @@ If you encounter an error when trying to enable the SIEM connector application, ## Related topics - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) -- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) -- [Microsoft Defender ATP alert API fields](api-portal-mapping.md) -- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) +- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) +- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) +- [Microsoft Defender ATP Detection fields](api-portal-mapping.md) +- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md index a866f2ef4f..4326359b13 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md @@ -54,6 +54,31 @@ From that page, you can do any of the following depending on what you need to do - Choose from exception options - Submit an exception, provide justification, and set exception duration if you can't remediate the issue just yet due to specific business reasons, compensation controls, or if it is a false positive. +## Report inaccuracy + +You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated security recommendation information in the machine page. + +1. Select the **Security recommendation** tab. + +2. Click **:** beside the security recommendation that you want to report about, then select **Report inaccuracy**. +![Screenshot of Report inaccuracy control from the machine page under the Security recommendation column](images/tvm_report_inaccuracy.png) +
A flyout pane opens.
+![Screenshot of Report inaccuracy flyout pane](images/tvm_report_inaccuracyflyout.png) + +3. From the flyout pane, select the inaccuracy category from the drop-down menu. +
![Screenshot of Report inaccuracy categories drop-down menu](images/tvm_report_inaccuracyoptions.png)
+ +4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported. + +5. Include your machine name for investigation context. + +>[!NOTE] +> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context. + +6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context. + + + ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md index 6954b3f5d6..a3004a88db 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md @@ -33,6 +33,30 @@ In the field of discovery, we are leveraging the same set of signals in Microsof Since it is real-time, in a matter of minutes, you will see vulnerability information as they get discovered. The engine automatically grabs information from multiple security feeds. In fact, you'll will see if a particular application is connected to a live campaign. It also provides a link to a Threat Analytics report soon as it's available. +## Report inaccuracy + +You can report a false positive when you see any vague, inaccurate version, incomplete, or already remediated software inventory information in the machine page. + +1. Select the **Software inventory** tab. + +2. Click **:** beside the software that you want to report about, and then select **Report inaccuracy**. +![Screenshot of Report inaccuracy control from the machine page under the Software inventory column](images/tvm_report_inaccuracy_software.png) +
A flyout pane opens.
+![Screenshot of Report inaccuracy flyout pane](images/tvm_report_inaccuracy_softwareflyout.png) + +3. From the flyout pane, select the inaccuracy category from the **Software inventory inaccuracy reason** drop-down menu. +
![Screenshot of Report inaccuracy software inventory inaccuracy reason drop-down menu](images/tvm_report_inaccuracy_softwareoptions.png)
+ +4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported. + +5. Include your machine name for investigation context. + +>[!NOTE] +> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context. + +6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context. + + ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index 108aef13b2..4bbbfb545d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -26,7 +26,7 @@ Threat & Vulnerability Management leverages the same signals in Microsoft Defend The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization, their severity, Common Vulnerability Scoring System (CVSS) rating, its prevalence in your organization, corresponding breach, and threat insights. ## Navigate through your organization's weaknesses page -You can see the list of vulnerabilities in three ways: +You can see the list of vulnerabilities in four ways: *Vulnerabilities in global search* 1. Click the global search drop-down menu. @@ -48,6 +48,18 @@ You can see the list of vulnerabilities in three ways: 3. Select the **Discovered vulnerabilities** tab. 4. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. +*Discovered vulnerabilities in the machine page* +1. Go to the left-hand navigation menu bar, then select the machine icon. The **Machines list** page opens. +
![Screenshot of Machines list page](images/tvm_machineslist.png)
+2. In the **Machines list** page, select the machine that you want to investigate. +
![Screenshot of machine list with selected machine to investigate](images/tvm_machinetoinvestigate.png)
+
A flyout pane opens with machine details and response action options.
+![Screenshot of the flyout pane with machine details and response options](images/tvm_machine_page_flyout.png) +3. In the flyout pane, select **Open machine page**. A page opens with details and response options for the machine you want to investigate. +
![Screenshot of the machine page with details and response options](images/tvm_machines_discoveredvuln.png)
+4. Select **Discovered vulnerabilities**. +5. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. + ## How it works When new vulnerabilities are released, you would want know how many of your assets are exposed. You can see the list of vulnerabilities and the details in the **Weaknesses** page. @@ -66,6 +78,29 @@ The threat insights icons are highlighted if there are associated exploits in th >[!NOTE] > Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight ![threat insight](images/tvm_bug_icon.png) icon and possible active alert ![possible active alert](images/tvm_alert_icon.png) icon. +## Report inaccuracy + +You can report a false positive when you see any vague, inaccurate, missing, or already remediated vulnerability information in the machine page. + +1. Select the **Discovered vulnerabilities** tab. + +2. Click **:** beside the vulnerability that you want to report about, and then select **Report inaccuracy**. +![Screenshot of Report inaccuracy control from the machine page in the Discovered vulnerabilities tab](images/tvm_report_inaccuracy_vuln.png) +
A flyout pane opens.
+![Screenshot of Report inaccuracy flyout pane](images/tvm_report_inaccuracy_vulnflyout.png) + +3. From the flyout pane, select the inaccuracy category from the **Discovered vulnerability inaccuracy reason** drop-down menu. +
![Screenshot of discovered vulnerability inaccuracy reason drop-down menu](images/tvm_report_inaccuracy_vulnoptions.png)
+ +4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported. + +5. Include your machine name for investigation context. + +>[!NOTE] +> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context. + +6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context. + ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md index 856b617100..8d22a596c8 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md @@ -35,6 +35,9 @@ This topic describes the structure of this profile (including a recommended prof The configuration profile is a .plist file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences. +>[!CAUTION] +>The layout of the configuration profile depends on the management console that you are using. The following sections contain examples of configuration profiles for JAMF and Intune. + The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections. ### Antivirus engine preferences @@ -222,6 +225,8 @@ The following configuration profile will: - Enable cloud delivered protection - Enable automatic sample submission +### JAMF profile + ```XML @@ -258,10 +263,91 @@ The following configuration profile will: ``` +### Intune profile + +```XML + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + antivirusEngine + + enableRealTimeProtection + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + automaticSampleSubmission + + + + + + +``` + ## Full configuration profile example The following configuration profile contains entries for all settings described in this document and can be used for more advanced scenarios where you want more control over the product. +### JAMF profile + ```XML @@ -329,6 +415,116 @@ The following configuration profile contains entries for all settings described ``` +### Intune profile + +```XML + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + antivirusEngine + + enableRealTimeProtection + + exclusions + + + $type + excludedPath + isDirectory + + path + /var/log/system.log + + + $type + excludedPath + isDirectory + + path + /home + + + $type + excludedFileExtension + extension + pdf + + + allowedThreats + + eicar + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + diagnosticLevel + optional + automaticSampleSubmission + + + + + + +``` + ## Configuration profile deployment Once you've built the configuration profile for your enterprise, you can deploy it through the management console that your enterprise is using. The following sections provide instructions on how to deploy this profile using JAMF and Intune.
MessageDate
Status update: Windows 10, version 1903 \"D\" optional release available August 30th
The August optional monthly “D” release for Windows 10, version 1903 is now available. Follow @WindowsUpdate for the latest on the availability of this release.
August 30, 2019
08:00 AM PT
Feature update install notification on Windows 10, version 1809 (the October 2018 Update)
We've had reports on August 29th that some customers running Windows 10, version 1809 (the October 2018 Update) have received notification to install the latest feature update (version 1903) early. Updating remains in your control. To install the update, you must select one of the following options: \"Pick a Time\", \"Restart Tonight,\" or \"Restart Now\". If you are not ready to update at this time, simply dismiss the notification by clicking the arrow in the top right corner. If you have updated to Windows 10, version 1903 and would like to go back to your previous version, see the instructions here.
August 29, 2019
04:39 PM PT
Take Action: Internet Explorer 11 now available on Windows Update/WSUS for Windows Server 2012 and Windows Embedded 8 Standard
Internet Explorer 11 (KB 4492872) is now available via Windows Update (WU) and Windows Server Update Services (WSUS) for commercial customers running Windows Server 2012 and Windows Embedded 8 Standard. For details about these changes and end of support for IE10, please refer to the IT Pro blog. 
August 29, 2019
08:00 AM PT
Take action: SHA-2 code signing support guidance for Windows 7 SP1 and Windows Server 2008 RS2 SP1
Windows 7 SP1 and Windows Server 2008 R2 SP1 update signatures are now SHA-2 based signatures and requires that SHA-2 support to be installed. For important customer guidance on installation and troubleshooting tips, please read the knowledge base article 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.
August 23, 2019
03:35 PM PT
Take action: Windows 10, version 1703 (the Windows 10 Creators Update) reaches end of life on October 9, 2019
The Enterprise and Education editions of Windows 10, version 1703 (the Windows 10 Creators Update) will reach end of life on October 9, 2019. The Home, Pro, Pro for Workstations, and IoT Core editions reached end of service on October 8, 2018.

There is no extended support available for any edition of Windows 10, version 1703. Therefore, it will no longer be supported after October 9, 2019 and will not receive monthly security and quality updates containing protections from the latest security threats.

To continue receiving security and quality updates, Microsoft recommends that you update your devices to the latest version of Windows 10. For more information on end of service dates and currently supported versions of Windows 10, see the Windows lifecycle fact sheet.
August 23, 2019
02:17 PM PT