mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 21:37:22 +00:00
Merge branch 'master' into indicators-update
This commit is contained in:
Joey Caparas
commit
f4d704e35c
@ -14783,7 +14783,7 @@
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md",
|
||||
"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts",
|
||||
"redirect_document_id": true
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md",
|
||||
@ -14793,7 +14793,7 @@
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md",
|
||||
"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines",
|
||||
"redirect_document_id": true
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md",
|
||||
@ -15136,6 +15136,21 @@
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md",
|
||||
"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines.md",
|
||||
"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp/is-ip-seen-org.md",
|
||||
"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp/exposed-apis-list",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md",
|
||||
"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/machineaction",
|
||||
"redirect_document_id": true
|
||||
|
||||
@ -9,18 +9,22 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 06/26/2017
|
||||
ms.date: 08/05/2019
|
||||
---
|
||||
|
||||
# DiagnosticLog CSP
|
||||
|
||||
The DiagnosticLog configuration service provider (CSP) is used in the following scenarios:
|
||||
- [Controlling ETW trace sessions](#diagnosticlog-csp-for-controlling-etw-trace-sessions)
|
||||
- [Triggering devices to upload existing event logs, log files, and registry values to cloud storage](#diagnosticlog-csp-for-triggering-devices-to-upload-files-to-cloud)
|
||||
|
||||
The DiagnosticLog configuration service provider (CSP) is used for generating and collecting diagnostic information from the device: Event Tracing for Windows (ETW) log files and current MDM configured state of the device.
|
||||
## DiagnosticLog CSP for controlling ETW trace sessions
|
||||
The DiagnosticLog CSP is used for generating and collecting diagnostic information from the device: Event Tracing for Windows (ETW) log files and current MDM configured state of the device.
|
||||
|
||||
DiagnosticLog CSP supports the following type of event tracing:
|
||||
|
||||
- Collector-based tracing
|
||||
- Channel-based tracing
|
||||
- Collector-based tracing
|
||||
- Channel-based tracing
|
||||
|
||||
### Collector-based tracing
|
||||
|
||||
@ -49,11 +53,10 @@ For each registered provider in this collector, the user can:
|
||||
|
||||
The changes on **State**, **Keywords** and **TraceLevel** takes effect immediately while trace session is in progress.
|
||||
|
||||
> **Note** Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode.
|
||||
> [!Note]
|
||||
> Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode.
|
||||
|
||||
|
||||
|
||||
### Channel-based tracing
|
||||
### Channel-based tracing
|
||||
|
||||
The type of event tracing exports event data from a specific channel. This is only supported on the desktop.
|
||||
|
||||
@ -73,36 +76,31 @@ Here are the links to the DDFs:
|
||||
|
||||
- [DiagnosticLog CSP version 1.2](diagnosticlog-ddf.md#version-1-2)
|
||||
- [DiagnosticLog CSP version 1.3](diagnosticlog-ddf.md#version-1-3)
|
||||
- [DiagnosticLog CSP version 1.4](diagnosticlog-ddf.md#version-1-4)
|
||||
|
||||
The following diagram shows the DiagnosticLog configuration service provider in tree format.
|
||||
The following diagram shows the DiagnosticLog CSP in tree format.
|
||||
|
||||
|
||||
|
||||
<a href="" id="--vendor-msft-diagnosticlog"></a>**./Vendor/MSFT/DiagnosticLog**
|
||||
The root node for the DiagnosticLog configuration service provider.
|
||||
The root node for the DiagnosticLog CSP.
|
||||
|
||||
The following steps describe the process for gathering diagnostics using this CSP.
|
||||
To gather diagnostics using this CSP:
|
||||
|
||||
1. Specify a *CollectorName* for the container of the target ETW providers.
|
||||
2. (Optional) Set logging and log file parameters using the following options:
|
||||
|
||||
- **TraceLogFileMode**
|
||||
- **LogFileSizeLimitMB**
|
||||
|
||||
Each of these are described later in this topic.
|
||||
- <a href="#etwlog-collectors-collectorname-tracelogfilemode">TraceLogFileMode</a>
|
||||
- <a href="#etwlog-collectors-collectorname-logfilesizelimitmb">LogFileSizeLimitMB</a>
|
||||
|
||||
3. Indicate one or more target ETW providers by supplying its *ProviderGUID* to the Add operation of EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*.
|
||||
4. (Optional) Set logging and log file parameters using the following options:
|
||||
|
||||
- **TraceLevel**
|
||||
- **Keywords**
|
||||
|
||||
Each of these are described later in this topic.
|
||||
|
||||
5. Start logging using **TraceControl** EXECUTE command “START”
|
||||
- <a href="#etwlog-collectors-collectorname-providers-providerguid-tracelevel">TraceLevel</a>
|
||||
- <a href="#etwlog-collectors-collectorname-providers-providerguid-keywords">Keywords</a>
|
||||
5. Start logging using **TraceControl** EXECUTE command “START”.
|
||||
6. Perform actions on the target device that will generate activity in the log files.
|
||||
7. Stop logging using **TraceControl** EXECUTE command “STOP”
|
||||
8. Collect the log file located in the `%temp%` folder using the method described in [Reading a log file](#reading-a-log-file)
|
||||
7. Stop logging using **TraceControl** EXECUTE command “STOP”.
|
||||
8. Collect the log file located in the `%temp%` folder using the method described in [Reading a log file](#reading-a-log-file).
|
||||
|
||||
<a href="" id="etwlog"></a>**EtwLog**
|
||||
Node to contain the Error Tracing for Windows log.
|
||||
@ -174,8 +172,6 @@ The following table represents the possible values:
|
||||
| 0 | Stopped |
|
||||
| 1 | Started |
|
||||
|
||||
|
||||
|
||||
<a href="" id="etwlog-collectors-collectorname-tracelogfilemode"></a>**EtwLog/Collectors/*CollectorName*/TraceLogFileMode**
|
||||
Specifies the log file logging mode.
|
||||
|
||||
@ -185,30 +181,10 @@ Supported operations are Get and Replace.
|
||||
|
||||
The following table lists the possible values:
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Value</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>EVENT_TRACE_FILE_MODE_SEQUENTIAL (0x00000001)</p></td>
|
||||
<td><p>Writes events to a log file sequentially; stops when the file reaches its maximum size.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>EVENT_TRACE_FILE_MODE_CIRCULAR (0x00000002)</p></td>
|
||||
<td><p>Writes events to a log file. After the file reaches the maximum size, the oldest events are replaced with incoming events.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
| Value | Description |
|
||||
|-------|--------------------|
|
||||
| EVENT_TRACE_FILE_MODE_SEQUENTIAL (0x00000001) | Writes events to a log file sequentially; stops when the file reaches its maximum size. |
|
||||
| EVENT_TRACE_FILE_MODE_CIRCULAR (0x00000002) | Writes events to a log file. After the file reaches the maximum size, the oldest events are replaced with incoming events. |
|
||||
|
||||
<a href="" id="etwlog-collectors-collectorname-tracecontrol"></a>**EtwLog/Collectors/*CollectorName*/TraceControl**
|
||||
Specifies the logging and report action state.
|
||||
@ -222,8 +198,6 @@ The following table lists the possible values:
|
||||
| START | Start log tracing. |
|
||||
| STOP | Stop log tracing |
|
||||
|
||||
|
||||
|
||||
The supported operation is Execute.
|
||||
|
||||
After you have added a logging task, you can start a trace by running an Execute command on this node with the value START.
|
||||
@ -295,8 +269,6 @@ Dynamic nodes to represent active provider configuration per provider GUID.
|
||||
|
||||
> **Note** Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode.
|
||||
|
||||
|
||||
|
||||
Supported operations are Add, Delete, and Get.
|
||||
|
||||
Add a provider
|
||||
@ -347,44 +319,15 @@ The data type is an integer.
|
||||
|
||||
Supported operations are Get and Replace.
|
||||
|
||||
The following table lists the possible values.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Value</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>1 – TRACE_LEVEL_CRITICAL</p></td>
|
||||
<td><p>Abnormal exit or termination events</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>2 – TRACE_LEVEL_ERROR</p></td>
|
||||
<td><p>Severe error events</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>3 – TRACE_LEVEL_WARNING</p></td>
|
||||
<td><p>Warning events such as allocation failures</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>4 – TRACE_LEVEL_INFORMATION</p></td>
|
||||
<td><p>Non-error events, such as entry or exit events</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>5 – TRACE_LEVEL_VERBOSE</p></td>
|
||||
<td><p>Detailed information</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
The following table lists the possible values:
|
||||
|
||||
| Value | Description |
|
||||
|-------|--------------------|
|
||||
| 1 – TRACE_LEVEL_CRITICAL | Abnormal exit or termination events |
|
||||
| 2 – TRACE_LEVEL_ERROR | Severe error events |
|
||||
| 3 – TRACE_LEVEL_WARNING | Warning events such as allocation failures |
|
||||
| 4 – TRACE_LEVEL_INFORMATION | Non-error events, such as entry or exit events |
|
||||
| 5 – TRACE_LEVEL_VERBOSE | Detailed information |
|
||||
|
||||
Set provider **TraceLevel**
|
||||
|
||||
@ -412,7 +355,7 @@ Set provider **TraceLevel**
|
||||
<a href="" id="etwlog-collectors-collectorname-providers-providerguid-keywords"></a>**EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*/Keywords**
|
||||
Specifies the provider keywords to be used as MatchAnyKeyword for this provider.
|
||||
|
||||
the data type is a string.
|
||||
The data type is a string.
|
||||
|
||||
Supported operations are Get and Replace.
|
||||
|
||||
@ -470,32 +413,11 @@ The data type is a boolean.
|
||||
|
||||
Supported operations are Get and Replace. This change will be effective during active trace session.
|
||||
|
||||
The following table lists the possible values. Default value is TRUE.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Value</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>TRUE</p></td>
|
||||
<td><p>Provider is enabled in the trace session.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>FALSE</p></td>
|
||||
<td><p>Provider is disables in the trace session.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
The following table lists the possible values:
|
||||
| Value | Description |
|
||||
|-------|--------------------|
|
||||
| TRUE | Provider is enabled in the trace session. This is the default. |
|
||||
| FALSE | Provider is disabled in the trace session. |
|
||||
|
||||
Set provider **State**
|
||||
|
||||
@ -630,32 +552,12 @@ The data type is a boolean.
|
||||
|
||||
Supported operations are Get and Replace.
|
||||
|
||||
The following table lists the possible values.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Value</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>TRUE</p></td>
|
||||
<td><p>Channel is enabled.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>FALSE</p></td>
|
||||
<td><p>Channel is disabled.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
The following table lists the possible values:
|
||||
|
||||
| Value | Description |
|
||||
|-------|--------------------|
|
||||
| TRUE | Channel is enabled. |
|
||||
| FALSE | Channel is disabled. |
|
||||
|
||||
Get channel **State**
|
||||
|
||||
@ -897,26 +799,585 @@ Node to transfer the selected log file block to the DM server.
|
||||
<a href="" id="filedownload-dmchannel-filecontext-datablocks-blocknumber"></a>**FileDownload/DMChannel/*FileContext*/DataBlocks/**<strong>*BlockNumber*</strong>
|
||||
The data type is Base64.
|
||||
|
||||
The only supported operation is Get.
|
||||
The supported operation is Get.
|
||||
|
||||
<a href="" id="policy"></a>**Policy**
|
||||
Added in version 1.4 of the CSP in Windows 10, version 1903. Root node to control settings for channels in Event Log.
|
||||
|
||||
The supported operation is Get.
|
||||
|
||||
<a href="" id="policy-channels"></a>**Policy/Channels**
|
||||
Added in version 1.4 of the CSP in Windows 10, version 1903. Node that contains Event Log channel settings.
|
||||
|
||||
The supported operation is Get.
|
||||
|
||||
<a href="" id="policy-channels-channelname"></a>**Policy/Channels/_ChannelName_**
|
||||
Added in version 1.4 of the CSP in Windows 10, version 1903. Dynamic node to represent a registered channel. The node name must be a valid Windows event log channel name, such as ``Microsoft-Client-Licensing-Platform%2FAdmin``. When specifying the name in the LocURI, it must be URL encoded, otherwise it may unexpectedly translate into a different URI.
|
||||
|
||||
Supported operations are Add, Delete, and Get.
|
||||
|
||||
Add **Channel**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Add>
|
||||
<CmdID>2</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName
|
||||
</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">node</Format>
|
||||
<Type></Type>
|
||||
</Meta>
|
||||
</Item>
|
||||
</Add>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
Delete **Channel**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Delete>
|
||||
<CmdID>3</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName
|
||||
</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Delete>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
Get **Channel**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Get>
|
||||
<CmdID>4</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName
|
||||
</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
<a href="" id="policy-channels-channelname-maximumfilesize"></a>**Policy/Channels/_ChannelName_/MaximumFileSize**
|
||||
Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting specifies the maximum size of the log file in megabytes.
|
||||
|
||||
If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte and 2 terabytes in megabyte increments.
|
||||
|
||||
If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte.
|
||||
|
||||
Supported operations are Add, Delete, Get, and Replace.
|
||||
|
||||
The data type is integer.
|
||||
|
||||
Add **MaximumFileSize**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Add>
|
||||
<CmdID>6</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize
|
||||
</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">int</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Data>3</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
Delete **MaximumFileSize**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Delete>
|
||||
<CmdID>7</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize
|
||||
</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Delete>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
Get **MaximumFileSize**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Get>
|
||||
<CmdID>5</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize
|
||||
</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
Replace **MaximumFileSize**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Replace>
|
||||
<CmdID>8</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize
|
||||
</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">int</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Data>5</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
<a href="" id="policy-channels-channelname-sddl"></a>**Policy/Channels/_ChannelName_/SDDL**
|
||||
Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting represents SDDL string controlling access to the channel.
|
||||
|
||||
Supported operations are Add, Delete, Get, and Replace.
|
||||
|
||||
The data type is string.
|
||||
|
||||
Default string is as follows:
|
||||
|
||||
https://docs.microsoft.com/en-us/windows/desktop/WES/eventmanifestschema-channeltype-complextype.
|
||||
|
||||
Add **SDDL**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Add>
|
||||
<CmdID>10</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL
|
||||
</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">chr</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Data>YourSDDL</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
Delete **SDDL**
|
||||
``` xml
|
||||
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Delete>
|
||||
<CmdID>11</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL
|
||||
</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Delete>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
Get **SDDL**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Get>
|
||||
<CmdID>9</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL
|
||||
</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
Replace **SDDL**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Replace>
|
||||
<CmdID>12</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL
|
||||
</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">chr</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Data>YourNewSDDL</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
<a href="" id="policy-channels-channelname-actionwhenfull"></a>**Policy/Channels/_ChannelName_/ActionWhenFull**
|
||||
Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting controls Event Log behavior when the log file reaches its maximum size.
|
||||
|
||||
Supported operations are Add, Delete, Get, and Replace.
|
||||
|
||||
The data type is string.
|
||||
|
||||
The following are the possible values:
|
||||
- Truncate — When the log file reaches its maximum file size, new events are not written to the log and are lost.
|
||||
- Overwrite — When the log file reaches its maximum file size, new events overwrite old events.
|
||||
- Archive — When the log file reaches its maximum size, the log file is saved to the location specified by the "Archive Location" policy setting. If archive location value is not set, the new file is saved in the same directory as current log file.
|
||||
|
||||
If you disable or do not configure this policy setting, the locally configured value will be used as default. Every channel that is installed, whether inbox or by ISVs, is responsible for defining its own local configuration, and that configuration can be changed by any administrator. Values set via this policy override but do not replace local configuration.
|
||||
|
||||
|
||||
Add **ActionWhenFull**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Add>
|
||||
<CmdID>14</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull
|
||||
</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">chr</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Data>Archive</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
Delete **ActionWhenFull**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Delete>
|
||||
<CmdID>15</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull
|
||||
</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Delete>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
Get **ActionWhenFull**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Get>
|
||||
<CmdID>13</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull
|
||||
</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
Replace **ActionWhenFull**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Replace>
|
||||
<CmdID>16</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull
|
||||
</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">chr</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Data>Truncate</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
<a href="" id="policy-channels-channelname-enabled"></a>**Policy/Channels/_ChannelName_/Enabled**
|
||||
Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting specifies whether the channel should be enabled or disabled.
|
||||
|
||||
Supported operations are Add, Delete, Get, and Replace.
|
||||
|
||||
The data type is boolean.
|
||||
|
||||
The following are the possible values:
|
||||
- TRUE — Enables the channel.
|
||||
- FALSE — Disables the channel.
|
||||
|
||||
If you disable or do not configure this policy setting, the locally configured value is used as default.
|
||||
|
||||
Get **Enabled**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Get>
|
||||
<CmdID>17</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled
|
||||
</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
Add **Enabled**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Add>
|
||||
<CmdID>18</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled
|
||||
</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">bool</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Data>TRUE</Data>
|
||||
</Item>
|
||||
</Add>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
Delete **Enabled**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Delete>
|
||||
<CmdID>19</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled
|
||||
</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Delete>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
Replace **Enabled**
|
||||
``` xml
|
||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||
<SyncBody>
|
||||
<Replace>
|
||||
<CmdID>20</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled
|
||||
</LocURI>
|
||||
</Target>
|
||||
<Meta>
|
||||
<Format xmlns="syncml:metinf">bool</Format>
|
||||
<Type>text/plain</Type>
|
||||
</Meta>
|
||||
<Data>FALSE</Data>
|
||||
</Item>
|
||||
</Replace>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
## DiagnosticLog CSP for triggering devices to upload files to cloud
|
||||
The DiagnosticLog CSP is used for triggering devices to upload existing event logs, log files, and registry values to cloud storage. The following section describes the nodes for the DiagnosticArchive functionality.
|
||||
|
||||
<a href="" id="diagnosticarchive"></a>**DiagnosticArchive**
|
||||
Added in version 1.4 of the CSP in Windows 10, version 1903. Root note for the DiagnosticArchive functionality.
|
||||
|
||||
The supported operation is Get.
|
||||
|
||||
<a href="" id="diagnosticarchive-archivedefinition"></a>**DiagnosticArchive/ArchiveDefinition**
|
||||
Added in version 1.4 of the CSP in Windows 10, version 1903.
|
||||
|
||||
The supported operations are Add and Execute.
|
||||
|
||||
The data type is string.
|
||||
|
||||
Expected value:
|
||||
Set and Execute are functionality equivalent, and each accepts an XML snippet (as a string) describing what data to gather and where to upload it when done. This XML defines what should be collected and compressed into a zip file to be uploaded to Azure blog storage.
|
||||
|
||||
The following is an example of the XML. This example instructs that a zip file be created containing the output from a dump of the specified registry key, all the files in a folder, the output of two commands, all the files in another folder, the output of a command, all the Application events, two sets of files, and another command output. All of this will be uploaded to the blob storage URL as specified in the <SasUrl> tags and must be in the noted format with the container and the key in the URL. The administrator can retrieve this URL from Azure. The file uploaded will be in the format DiagLogs-{ComputerName}-YYYYMMDDTHHMMSSZ.zip.
|
||||
|
||||
``` xml
|
||||
<Collection>
|
||||
<ID>f1e20cb4-9789-4f6b-8f6a-766989764c6d</ID>
|
||||
<SasUrl>{web address}/{container}{key}</SasUrl>
|
||||
<RegistryKey>HKLM\Software\Policies</RegistryKey>
|
||||
<FoldersFiles>C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\*.etl</FoldersFiles>
|
||||
<Command>%windir%\system32\ipconfig.exe /all</Command>
|
||||
<Command>%windir%\system32\mdmdiagnosticstool.exe -out c:\ProgramData\temp\</Command>
|
||||
<FoldersFiles>c:\ProgramData\temp\*.*</FoldersFiles>
|
||||
<Command>%windir%\system32\ping.exe -n 50 localhost</Command>
|
||||
<Events>Application</Events>
|
||||
<FoldersFiles>%ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl</FoldersFiles>
|
||||
<FoldersFiles>%SystemRoot%\System32\LogFiles\wmi\*.etl.*
|
||||
</FoldersFiles>
|
||||
<Command>%windir%\system32\pnputil.exe /enum-drivers</Command>
|
||||
</Collection>
|
||||
|
||||
```
|
||||
Where:
|
||||
|
||||
- ID is a unique GUID value that defines this particular run of the DiagnosticLog CSP.
|
||||
- There can be multiple RegistryKey, FolderFiles, Command, and Events elements, which extract or execute and collect the output from the action specified.
|
||||
- SasUrl is generated from the Azure Blob Storage UX in Azure such that it will allow write access to the blob to upload the zip file created by all the actions specified.
|
||||
|
||||
<a href="" id="diagnosticarchive-archiveresults"></a>**DiagnosticArchive/ArchiveResults**
|
||||
Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting displays the results of the last archive run.
|
||||
|
||||
The supported operation is Get.
|
||||
|
||||
The data type is string.
|
||||
|
||||
A Get to the above URI will return the results of the gathering of data for the last diagnostics request. For the example above it returns:
|
||||
|
||||
``` xml
|
||||
<SyncML>
|
||||
<SyncHdr/>
|
||||
<SyncBody>
|
||||
<Status>
|
||||
<CmdID>1</CmdID>
|
||||
<MsgRef>1</MsgRef>
|
||||
<CmdRef>0</CmdRef>
|
||||
<Cmd>SyncHdr</Cmd>
|
||||
<Data>200</Data>
|
||||
</Status>
|
||||
<Status>
|
||||
<CmdID>2</CmdID>
|
||||
<MsgRef>1</MsgRef>
|
||||
<CmdRef>1</CmdRef>
|
||||
<Cmd>Get</Cmd>
|
||||
<Data>200</Data>
|
||||
</Status>
|
||||
<Results>
|
||||
<CmdID>3</CmdID>
|
||||
<MsgRef>1</MsgRef>
|
||||
<CmdRef>1</CmdRef>
|
||||
<Item>
|
||||
<Source>
|
||||
<LocURI>./Vendor/MSFT/DiagnosticLog/DiagnosticArchive/ArchiveResults</LocURI>
|
||||
</Source>
|
||||
<Data>
|
||||
<Collection HRESULT="0">
|
||||
<ID>f1e20cb4-9789-4f6b-8f6a-766989764c6d</ID>
|
||||
<RegistryKey HRESULT="0">HKLM\Software\Policies</RegistryKey>
|
||||
<FoldersFiles HRESULT="0">C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\*.etl</FoldersFiles>
|
||||
<Command HRESULT="0">%windir%\system32\ipconfig.exe /all</Command>
|
||||
<Command HRESULT="-2147024637">%windir%\system32\mdmdiagnosticstool.exe -out c:\ProgramData\temp\</Command>
|
||||
<FoldersFiles HRESULT="0">c:\ProgramData\temp\*.*</FoldersFiles>
|
||||
<Command HRESULT="0">%windir%\system32\ping.exe -n 50 localhost</Command>
|
||||
<Events HRESULT="0">Application</Events>
|
||||
<FoldersFiles HRESULT="0">%ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl</FoldersFiles>
|
||||
<FoldersFiles HRESULT="0">%SystemRoot%\System32\LogFiles\wmi\*.etl.*</FoldersFiles>
|
||||
<Command HRESULT="0">%windir%\system32\pnputil.exe /enum-drivers</Command>
|
||||
</Collection>
|
||||
</Data>
|
||||
</Item>
|
||||
</Results>
|
||||
<Final/>
|
||||
</SyncBody>
|
||||
</SyncML>
|
||||
```
|
||||
> [!Note]
|
||||
> Each data gathering node is annotated with the HRESULT of the option and the collection is also annotated with an HRESULT. In this example, note that the mdmdiagnosticstool.exe command failed.
|
||||
|
||||
## Reading a log file
|
||||
|
||||
|
||||
1. Enumerate log file under **./Vendor/MSFT/DiagnosticLog/FileDownload/DMChannel**
|
||||
2. Select a log file in the Enumeration result
|
||||
3. Set **BlockSizeKB** per DM server payload limitation
|
||||
4. Get **BlockCount** to determine total read request
|
||||
5. Set **BlockIndexToRead** to initialize read start point
|
||||
6. Get **BlockData** for upload log block
|
||||
7. Increase **BlockIndexToRead**
|
||||
8. Repeat step 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
To read a log file:
|
||||
1. Enumerate log file under **./Vendor/MSFT/DiagnosticLog/FileDownload/DMChannel**.
|
||||
2. Select a log file in the Enumeration result.
|
||||
3. Set **BlockSizeKB** per DM server payload limitation.
|
||||
4. Get **BlockCount** to determine total read request.
|
||||
5. Set **BlockIndexToRead** to initialize read start point.
|
||||
6. Get **BlockData** for upload log block.
|
||||
7. Increase **BlockIndexToRead**.
|
||||
8. Repeat step 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)**.
|
||||
@ -23,6 +23,7 @@ The content below are the latest versions of the DDF files:
|
||||
|
||||
- [DiagnosticLog CSP version 1.2](#version-1-2)
|
||||
- [DiagnosticLog CSP version 1.3](#version-1-3)
|
||||
- [DiagnosticLog CSP version 1.4](#version-1-4)
|
||||
|
||||
## <a href="" id="version-1-2"></a>DiagnosticLog CSP version 1.2
|
||||
|
||||
@ -1284,6 +1285,893 @@ The content below are the latest versions of the DDF files:
|
||||
</MgmtTree>
|
||||
```
|
||||
|
||||
## <a href="" id="version-1-4"></a>DiagnosticLog CSP version 1.4
|
||||
```xml
|
||||
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE MgmtTree PUBLIC " -//OMA//DTD-DM-DDF 1.2//EN"
|
||||
"http://www.openmobilealliance.org/tech/DTD/DM_DDF-V1_2.dtd"
|
||||
[<?oma-dm-ddf-ver supported-versions="1.2"?>]>
|
||||
<MgmtTree xmlns:MSFT="http://schemas.microsoft.com/MobileDevice/DM">
|
||||
<VerDTD>1.2</VerDTD>
|
||||
<Node>
|
||||
<NodeName>DiagnosticLog</NodeName>
|
||||
<Path>./Vendor/MSFT</Path>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>com.microsoft/1.4/MDM/DiagnosticLog</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>EtwLog</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Root node of all types of event logging nodes that CSP manages.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>Collectors</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Root node of registered "Collector" nodes.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName></NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Each dynamic node represents a registered 'Collector' node. CSP will maintain an ETW trace session for this collector with its name used as a unique identifier. In a collector, a valid ETW provider can be registered and unregistered. The collector's associated trace session will enable the registered providers in it if the provider's state is 'Enabled'. Each provider's state, trace level and keywords can be controlled separately. The name of this node must not be a valid Windows event channel name. It can be a etw provider guid as long as it is not equal to an already registered 'Provider' node name.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrMore />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFTitle>CollectorName</DFTitle>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>TraceStatus</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>This node is used for getting the status of this collector node's associated trace session. 1 means "in progress"; 0 means "not started or stopped".</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>TraceLogFileMode</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>1</DefaultValue>
|
||||
<Description>This node is used for setting or getting the trace log file mode of this collector node's associated trace session. The only two allowed values are 1 and 2, which are EVENT_TRACE_FILE_MODE_SEQUENTIAL and EVENT_TRACE_FILE_MODE_CIRCULAR. Default value is 1.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>TraceControl</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Exec />
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>This node is to trigger "start" and "stop" of this collector node's associated trace session. "Get" returns the name of this node.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>LogFileSizeLimitMB</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>4</DefaultValue>
|
||||
<Description>This node is used for setting or getting the trace log file size limit(in Megabytes) of this collector node's associated trace session. The value range is 1~2048. Default value is 4.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Providers</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Root node of all providers registered in this collector node.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName></NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Each dynamic node represents an ETW provider registered in this collector node. The node name must be a valid provider GUID.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrMore />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFTitle>ProviderGuid</DFTitle>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>Keywords</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>"0"</DefaultValue>
|
||||
<Description>This node is used for setting or getting the keywords of the event provider in this collector node's associated trace session. The string is in the form of hexadecimal digits and 16 chars wide. It'll be internally converted into ULONGLONG data type in the CSP. Default value is "0", which means all events from this provider are included. If the associated trace session is in progress, new keywords setting is applied immediately; if not, it'll be applied next time that session is started.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>TraceLevel</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>5</DefaultValue>
|
||||
<Description>This node is used for setting or getting the trace level of this event provider in this collector node's associated trace session. Default value is 5, which is TRACE_LEVEL_VERBOSE. If the associated trace session is in progress, new trace level setting is applied immediately;if not, it'll be applied next time that session is started.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>State</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>true</DefaultValue>
|
||||
<Description>This node is used for setting or getting the state of the event provider in this collector node's associated trace session. If the trace session isn't started, changing the value controls whether to enable the provider or not when session is started; if trace session is already started, changing its value causes enabling or disabling the provider in the live trace session. Default value is true.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Channels</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Root node of registered "Channel" nodes.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName></NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Each dynamic node represents a registered 'Channel' node. The node name must be a valid Windows event log channel name, e.g. "Microsoft-Client-Licensing-Platform%2FAdmin". When specifying the name in the LocURI, it must be url encoded or it'll be translated into a different URI unexpectedly.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrMore />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFTitle>ChannelName</DFTitle>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>Export</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Exec />
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>This node is to trigger exporting events into a log file from this node's associated Windows event channel. The log file's extension is .evtx, which is the standard extension of windows event channel log. The "Get" command returns the name of this node.</Description>
|
||||
<DFFormat>
|
||||
<null />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>State</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>This node is used for setting or getting the 'Enabled' state of this node's associated windows event channel in the system. Setting it to "TRUE" enables the channel; setting it to "FALSE" disables the channel. </Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Filter</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>""</DefaultValue>
|
||||
<Description>This node is used for setting or getting the xpath query string to filter the events when exporting the log file from the channel. Default value is empty string.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>DeviceStateData</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Root node of all types of device state data that CSP exposes.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>MdmConfiguration</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Exec />
|
||||
</AccessType>
|
||||
<Description>This node is to trigger snapping of the Device Management state data with "SNAP".</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>FileDownload</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Root node of all csp nodes that are related to log file download in csp.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>DMChannel</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Root node of all csp nodes that are used for controlling file download for their associated log file generated by logging csp nodes.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName></NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Each dynamic node represents a 'FileContext' node corresponding to a log file generated by one of the logging CSP nodes(underneath 'EtwLog' node). The node name must be the name of a registered 'Provider', 'Collector' or 'Channel' node. The log file and its location will be determined by CSP based on the node name. File download is done by dividing the log file into multiple blocks of configured block size and then sending the blocks as requested by MDM server.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrMore />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFTitle>FileContext</DFTitle>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>BlockSizeKB</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DefaultValue>4</DefaultValue>
|
||||
<Description>This node is used for setting or getting the block size (in Kilobytes) for the download of assoicated log file. The value range is 1~16. Default value is 4.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>BlockCount</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>This node is used for getting the total number of blocks for the associated log file. If the log file isn't generated yet, the value returned is -1; if the trace session is in progress, the value returned is -2.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>BlockIndexToRead</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>This node is used for setting and getting the block index that points to the data block for 'BlockData' node. The value range is 0~(BlockCount-1).</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>BlockData</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>This node is used to get the binary data of the block that 'BlockIndexToRead' node is pointing to.</Description>
|
||||
<DFFormat>
|
||||
<b64 />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>DataBlocks</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Root node of all 'BlockNumber' nodes for the associated log file. The number of its children should be the total block count of the log file. No children nodes exist if 'BlockCount' node's value is less than 0.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName></NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Each dynamic node represents a 'BlockNumber' node. The node name is an integer equal to the index of the block which this node stands for. Therefore the node name should be ranging from 0 to (BlockCount -1). It returns the binary data of the block which this node is referring to.</Description>
|
||||
<DFFormat>
|
||||
<b64 />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrMore />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFTitle>BlockNumber</DFTitle>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Policy</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Contains policy for diagnostic settings.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<CaseSense>
|
||||
<CIS />
|
||||
</CaseSense>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>Channels</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Contains policy for Event Log channel settings.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName></NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Add />
|
||||
<Delete />
|
||||
</AccessType>
|
||||
<Description>Each dynamic node represents a registered 'Channel' node. The node name must be a valid Windows event log channel name, e.g. "Microsoft-Client-Licensing-Platform%2FAdmin". When specifying the name in the LocURI, it must be url encoded or it'll be translated into a different URI unexpectedly.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrMore />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFTitle>ChannelName</DFTitle>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>MaximumFileSize</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Add />
|
||||
<Delete />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Maximum size of the channel log file in MB.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrOne />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>SDDL</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Add />
|
||||
<Delete />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>SDDL String controlling access to the channel. Default: https://docs.microsoft.com/en-us/windows/desktop/WES/eventmanifestschema-channeltype-complextype</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrOne />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<CaseSense>
|
||||
<CS />
|
||||
</CaseSense>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>ActionWhenFull</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Add />
|
||||
<Delete />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Action to take when the log file reaches maximum size. "Truncate", "Overwrite", "Archive".</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrOne />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<CaseSense>
|
||||
<CIS />
|
||||
</CaseSense>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Enabled</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Add />
|
||||
<Delete />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>This policy setting specifies whether the channel should be enabled or disabled. Set value to TRUE to enable and FALSE to disable.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrOne />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>DiagnosticArchive</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Root note for archive definition and collection.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>ArchiveDefinition</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Exec />
|
||||
</AccessType>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>ArchiveResults</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Pull up the results of the last archive run.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<CaseSense>
|
||||
<CIS />
|
||||
</CaseSense>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
</MgmtTree>
|
||||
```
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
|
||||
@ -22,6 +22,7 @@ Requirements:
|
||||
- The enterprise has configured a mobile device management (MDM) service
|
||||
- The enterprise AD must be [registered with Azure Active Directory (Azure AD)](azure-active-directory-integration-with-mdm.md)
|
||||
- The device should not already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`)
|
||||
- The minimum Windows Server version requirement is based on the Hybrid AAD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan) for more information.
|
||||
|
||||
> [!TIP]
|
||||
> For additional information, see the following topics:
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 28 KiB After Width: | Height: | Size: 86 KiB |
@ -144,6 +144,13 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
<td style="vertical-align:top"><p>Added new CSP in Windows 10, version 1903.</p>
|
||||
</td></tr>
|
||||
<tr>
|
||||
<td style="vertical-align:top"><a href="diagnosticlog-csp.md" data-raw-source="[DiagnosticLog CSP](diagnosticlog-csp.md)">DiagnosticLog CSP</a><br>
|
||||
<a href="diagnosticlog-ddf.md" data-raw-source="[DiagnosticLog DDF](diagnosticlog-ddf.md)">DiagnosticLog DDF</a></td>
|
||||
<td style="vertical-align:top"><p>Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:<br>
|
||||
Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.
|
||||
</p>
|
||||
</td></tr>
|
||||
<tr>
|
||||
<td style="vertical-align:top"><a href="enrollmentstatustracking-csp.md" data-raw-source="[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)">EnrollmentStatusTracking CSP</a></td>
|
||||
<td style="vertical-align:top"><p>Added new CSP in Windows 10, version 1903.</p>
|
||||
</td></tr>
|
||||
@ -1896,6 +1903,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o
|
||||
|
||||
|New or updated topic | Description|
|
||||
|--- | ---|
|
||||
|[DiagnosticLog CSP](diagnosticlog-csp.md)<br>[DiagnosticLog DDF](diagnosticlog-ddf.md)|Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:<br>Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.|
|
||||
|[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Enhanced the article to include additional reference links and the following two topics:<br>Verify auto-enrollment requirements and settings, Troubleshoot auto-enrollment of devices.|
|
||||
|
||||
### July 2019
|
||||
|
||||
@ -32,6 +32,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Date resolved</td></tr>
|
||||
<tr><td><div id='674msg'></div><b>Notification issue: \"Your device is missing important security and quality fixes.\"</b><br>Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"<br><br><a href = '#674msgdesc'>See details ></a></td><td>N/A <br><br><a href ='' target='_blank'></a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>September 03, 2019 <br>12:32 PM PT</td></tr>
|
||||
<tr><td><div id='650msg'></div><b>Devices starting using PXE from a WDS or SCCM servers may fail to start</b><br>Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"<br><br><a href = '#650msgdesc'>See details ></a></td><td>OS Build 17134.829<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503286' target='_blank'>KB4503286</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512509' target='_blank'>KB4512509</a></td><td>August 19, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='649msg'></div><b>Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error</b><br>Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.<br><br><a href = '#649msgdesc'>See details ></a></td><td>OS Build 17134.950<br><br>August 13, 2019<br><a href ='https://support.microsoft.com/help/4512501' target='_blank'>KB4512501</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512509' target='_blank'>KB4512509</a></td><td>August 19, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='628msg'></div><b>Domain connected devices that use MIT Kerberos realms will not start up</b><br>Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.<br><br><a href = '#628msgdesc'>See details ></a></td><td>OS Build 17134.915<br><br>July 16, 2019<br><a href ='https://support.microsoft.com/help/4507466' target='_blank'>KB4507466</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512501' target='_blank'>KB4512501</a></td><td>August 13, 2019 <br>10:00 AM PT</td></tr>
|
||||
@ -58,6 +59,15 @@ sections:
|
||||
<div>
|
||||
</div>
|
||||
"
|
||||
- title: September 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='674msgdesc'></div><b>Notification issue: \"Your device is missing important security and quality fixes.\"</b><div>Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1803</li><li>Server: Windows Server, version 1803</li></ul><div></div><div><strong>Resolution: </strong>This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting <strong>Check for Updates </strong>in the <strong>Windows Update </strong>dialog. For instructions, see <a href=\"https://support.microsoft.com/help/4027667/windows-10-update\" target=\"_blank\">Update Windows 10</a>. Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes. </div><br><a href ='#674msg'>Back to top</a></td><td>N/A <br><br><a href ='' target='_blank'></a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>Resolved:<br>September 03, 2019 <br>12:32 PM PT<br><br>Opened:<br>September 03, 2019 <br>12:32 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
- title: August 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
|
||||
@ -55,12 +55,6 @@ sections:
|
||||
<tr><td><div id='231msg'></div><b>End-user-defined characters (EUDC) may cause blue screen at startup</b><br>If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. <br><br><a href = '#231msgdesc'>See details ></a></td><td>OS Build 17763.404<br><br>April 02, 2019<br><a href ='https://support.microsoft.com/help/4490481' target='_blank'>KB4490481</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493509' target='_blank'>KB4493509</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='219msg'></div><b>MSXML6 may cause applications to stop responding </b><br>MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().<br><br><a href = '#219msgdesc'>See details ></a></td><td>OS Build 17763.253<br><br>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480116' target='_blank'>KB4480116</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493509' target='_blank'>KB4493509</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='213msg'></div><b>Error 1309 when installing/uninstalling MSI or MSP files</b><br>Users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.<br><br><a href = '#213msgdesc'>See details ></a></td><td>OS Build 17763.316<br><br>February 12, 2019<br><a href ='https://support.microsoft.com/help/4487044' target='_blank'>KB4487044</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4489899' target='_blank'>KB4489899</a></td><td>March 12, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='199msg'></div><b>Internet Explorer may fail to load images</b><br>Internet Explorer may fail to load images with a backslash (\\) in their relative source path.<br><br><a href = '#199msgdesc'>See details ></a></td><td>OS Build 17763.316<br><br>February 12, 2019<br><a href ='https://support.microsoft.com/help/4487044' target='_blank'>KB4487044</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>March 01, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='193msg'></div><b>First character of the Japanese era name not recognized</b><br>The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.<br><br><a href = '#193msgdesc'>See details ></a></td><td>OS Build 17763.316<br><br>February 12, 2019<br><a href ='https://support.microsoft.com/help/4487044' target='_blank'>KB4487044</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>March 01, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='179msg'></div><b>Applications using Microsoft Jet database and Access 95 file format stop working</b><br>Applications that use a Microsoft Jet database with the Microsoft Access 9 file format may randomly stop working.<br><br><a href = '#179msgdesc'>See details ></a></td><td>OS Build 17763.316<br><br>February 12, 2019<br><a href ='https://support.microsoft.com/help/4487044' target='_blank'>KB4487044</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>March 01, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='164msg'></div><b>Shared albums may not sync with iCloud for Windows</b><br>Upgrade block: Apple has identified an incompatibility with iCloud for Windows (version 7.7.0.27) where users may experience issues updating or synching Shared Albums.<br><br><a href = '#164msgdesc'>See details ></a></td><td>OS Build 17763.134<br><br>November 13, 2018<br><a href ='https://support.microsoft.com/help/4467708' target='_blank'>KB4467708</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>March 01, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='161msg'></div><b>Intel Audio Display (intcdaud.sys) notification during Windows 10 Setup</b><br>Upgrade block: Users may see an Intel Audio Display (intcdaud.sys) notification during setup for devices with certain Intel Display Audio Drivers.<br><br><a href = '#161msgdesc'>See details ></a></td><td>OS Build 17763.134<br><br>November 13, 2018<br><a href ='https://support.microsoft.com/help/4467708' target='_blank'>KB4467708</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>March 01, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='160msg'></div><b>F5 VPN clients losing network connectivity </b><br>Upgrade block: After updating to Windows 10, version 1809, F5 VPN clients may lose network connectivity when the VPN service is in a split tunnel configuration.<br><br><a href = '#160msgdesc'>See details ></a></td><td>OS Build 17763.134<br><br>November 13, 2018<br><a href ='https://support.microsoft.com/help/4467708' target='_blank'>KB4467708</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>March 01, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='159msg'></div><b>Global DNS outage affects Windows Update customers</b><br>Windows Update customers were recently affected by a network infrastructure event caused by an external DNS service provider's global outage. <br><br><a href = '#159msgdesc'>See details ></a></td><td>N/A <br><br><a href ='' target='_blank'></a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>March 08, 2019 <br>11:15 AM PT</td></tr>
|
||||
<tr><td><div id='158msg'></div><b>Apps may stop working after selecting an audio output device other than the default</b><br>Users with multiple audio devices that select an audio output device different from the \"Default Audio Device\" may find certain applications stop working unexpectedly.<br><br><a href = '#158msgdesc'>See details ></a></td><td>OS Build 17763.348<br><br>March 01, 2019<br><a href ='https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4490481' target='_blank'>KB4490481</a></td><td>April 02, 2019 <br>10:00 AM PT</td></tr>
|
||||
</table>
|
||||
@ -148,9 +142,6 @@ sections:
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='326msgdesc'></div><b>Embedded objects may display incorrectly</b><div>Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. </div><div> </div><div>For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. </div><div> </div><div><strong>Affected platforms:</strong> </div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution: </strong>This issue is resolved in <a href=\"https://support.microsoft.com/help/4493509\" target=\"_blank\">KB4493509</a>. </div><br><a href ='#326msg'>Back to top</a></td><td>OS Build 17763.316<br><br>February 12, 2019<br><a href ='https://support.microsoft.com/help/4487044' target='_blank'>KB4487044</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493509' target='_blank'>KB4493509</a></td><td>Resolved:<br>April 09, 2019 <br>10:00 AM PT<br><br>Opened:<br>February 12, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='213msgdesc'></div><b>Error 1309 when installing/uninstalling MSI or MSP files</b><div>After installing <a href=\"https://support.microsoft.com/help/4487044\" target=\"_blank\">KB4487044</a>, users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files. </div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution:</strong> This issue is resolved in <a href=\"https://support.microsoft.com/help/4489899\" target=\"_blank\">KB4489899</a>. </div><br><a href ='#213msg'>Back to top</a></td><td>OS Build 17763.316<br><br>February 12, 2019<br><a href ='https://support.microsoft.com/help/4487044' target='_blank'>KB4487044</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4489899' target='_blank'>KB4489899</a></td><td>Resolved:<br>March 12, 2019 <br>10:00 AM PT<br><br>Opened:<br>February 12, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='199msgdesc'></div><b>Internet Explorer may fail to load images</b><div>After installing <a href=\"https://support.microsoft.com/help/4487044\" target=\"_blank\">KB4487044</a>, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1</li></ul><div></div><div><strong>Resolution:</strong> This issue is resolved in <a href=\"https://support.microsoft.com/help/4482887\" target=\"_blank\">KB4482887</a>.</div><br><a href ='#199msg'>Back to top</a></td><td>OS Build 17763.316<br><br>February 12, 2019<br><a href ='https://support.microsoft.com/help/4487044' target='_blank'>KB4487044</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>Resolved:<br>March 01, 2019 <br>10:00 AM PT<br><br>Opened:<br>February 12, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='193msgdesc'></div><b>First character of the Japanese era name not recognized</b><div>After installing <a href=\"https://support.microsoft.com/help/4487044\" target=\"_blank\">KB4487044</a>, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues. </div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2</li></ul><div></div><div><strong>Resolution:</strong> This issue is resolved in <a href=\"https://support.microsoft.com/help/4482887\" target=\"_blank\">KB4482887</a>. </div><br><a href ='#193msg'>Back to top</a></td><td>OS Build 17763.316<br><br>February 12, 2019<br><a href ='https://support.microsoft.com/help/4487044' target='_blank'>KB4487044</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>Resolved:<br>March 01, 2019 <br>10:00 AM PT<br><br>Opened:<br>February 12, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='179msgdesc'></div><b>Applications using Microsoft Jet database and Access 95 file format stop working</b><div>Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2</li></ul><div></div><div><strong>Resolution:</strong> This issue is resolved in <a href=\"https://support.microsoft.com/help/4482887\" target=\"_blank\">KB4482887</a>.</div><br><a href ='#179msg'>Back to top</a></td><td>OS Build 17763.316<br><br>February 12, 2019<br><a href ='https://support.microsoft.com/help/4487044' target='_blank'>KB4487044</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>Resolved:<br>March 01, 2019 <br>10:00 AM PT<br><br>Opened:<br>February 12, 2019 <br>10:00 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
@ -171,8 +162,5 @@ sections:
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='438msgdesc'></div><b>Audio not working on monitors or TV connected to a PC via HDMI, USB, or DisplayPort</b><div><strong>Upgrade block:</strong> Microsoft has identified issues with certain new Intel display drivers. Intel inadvertently released versions of its display driver (versions 24.20.100.6344, 24.20.100.6345) to OEMs that accidentally turned on unsupported features in Windows. </div><div> </div><div>As a result, after updating to Windows 10, version 1809, audio playback from a monitor or television connected to a PC via HDMI, USB-C, or a DisplayPort may not function correctly on devices with these drivers.</div><div><strong>Note:</strong> This Intel display driver issue is different from the Intel Smart Sound Technology driver (version 09.21.00.3755) audio issue previously <a href=\"https://answers.microsoft.com/en-us/windows/forum/all/windows-10-audio-stops-working-after-installing/5a541c88-89e1-4bf3-b356-2837d564b109\" target=\"_blank\">documented</a>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019</li><li>Server: Windows Server, version 1809; Windows Server 2019 </li></ul><div></div><div><strong>Next steps:</strong> Intel has released updated drivers to OEM device manufacturers. OEMs need to make the updated driver available via Windows Update. For more information, see the <a href=\"https://www.intel.com/content/www/us/en/support/articles/000031612/graphics-drivers.html\" target=\"_blank\">Intel Customer Support article</a>.</div><div><br></div><div><strong>Resolution: </strong>Microsoft has removed the safeguard hold. </div><div><br></div><div><br></div><br><a href ='#438msg'>Back to top</a></td><td>OS Build 17763.134<br><br>November 13, 2018<br><a href ='https://support.microsoft.com/help/4467708' target='_blank'>KB4467708</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>Resolved:<br>May 21, 2019 <br>07:42 AM PT<br><br>Opened:<br>November 13, 2018 <br>10:00 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='164msgdesc'></div><b>Shared albums may not sync with iCloud for Windows</b><div><strong>Upgrade block:</strong> Users who attempt to install iCloud for Windows (version 7.7.0.27) will see a message displayed that this version iCloud for Windows isn't supported and the install will fail.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019</li><li>Server: Windows Server, version 1809; Windows Server 2019</li></ul><div></div><div>To ensure a seamless experience, Microsoft is blocking devices with iCloud for Windows (version 7.7.0.27) software installed from being offered Windows 10, version 1809 until this issue has been resolved. </div><div><br></div><div>We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool from the Microsoft software download website until this issue is resolved. </div><div> </div><div><strong>Resolution</strong>: Apple has released an updated version of iCloud for Windows (version 7.8.1) that resolves compatibility issues encountered when updating or synching Shared Albums after updating to Windows 10, version 1809. We recommend that you update your iCloud for Windows to version 7.8.1 when prompted before attempting to upgrade to Windows 10, version 1809. You can also manually download the latest version of iCloud for Windows by visiting <a href=\"https://support.apple.com/HT204283\" target=\"_blank\">https://support.apple.com/HT204283</a>.</div><br><a href ='#164msg'>Back to top</a></td><td>OS Build 17763.134<br><br>November 13, 2018<br><a href ='https://support.microsoft.com/help/4467708' target='_blank'>KB4467708</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>Resolved:<br>March 01, 2019 <br>10:00 AM PT<br><br>Opened:<br>November 13, 2018 <br>10:00 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='161msgdesc'></div><b>Intel Audio Display (intcdaud.sys) notification during Windows 10 Setup</b><div><strong>Upgrade block:</strong> Microsoft and Intel have identified a compatibility issue with a range of Intel Display Audio device drivers (intcdaud.sys, versions 10.25.0.3 - 10.25.0.8) that may result in excessive processor demand and reduced battery life. As a result, the update process to the Windows 10 October 2018 Update (Windows 10, version 1809) will fail and affected devices will automatically revert to the previous working configuration. </div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019</li><li>Server: Windows Server, version 1809; Windows Server 2019</li></ul><div></div><div>If you see a \"What needs your attention\" notification during installation of the October 2018 Update, you have one of these affected drivers on your system. On the notification, click <strong>Back</strong> to remain on your current version of Windows 10. </div><div> </div><div>To ensure a seamless experience, we are blocking devices from being offered the October 2018 Update until updated Intel device drivers are installed on your current operating system. We recommend that you do not attempt to manually update to Windows 10, version 1809, using the Update Now button or the Media Creation Tool from the <a href=\"https://www.microsoft.com/software-download/windows10\" target=\"_blank\">Microsoft Software Download Center</a> until newer Intel device drivers are available with the update. You can either wait for newer drivers to be installed automatically through Windows Update or check with your computer manufacturer for the latest device driver software availability and installation procedures. For more information about this issue, see <a href=\"https://www.intel.com/content/www/us/en/support/articles/000030792/graphics-drivers.html\" target=\"_blank\">Intel's customer support guidance</a>.</div><div> </div><div><strong>Resolution:</strong> This issue was resolved in <a href=\"https://support.microsoft.com/help/4482887\" target=\"_blank\">KB4482887</a> and the upgrade block removed. </div><br><a href ='#161msg'>Back to top</a></td><td>OS Build 17763.134<br><br>November 13, 2018<br><a href ='https://support.microsoft.com/help/4467708' target='_blank'>KB4467708</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>Resolved:<br>March 01, 2019 <br>10:00 AM PT<br><br>Opened:<br>November 13, 2018 <br>10:00 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='160msgdesc'></div><b>F5 VPN clients losing network connectivity </b><div><strong>Upgrade block:</strong> After updating to Windows 10, version 1809, F5 VPN clients may lose network connectivity when the VPN service is in a split tunnel configuration.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019</li><li>Server: Windows Server, version 1809; Windows Server 2019</li></ul><div></div><div><strong>Resolution:</strong> This issue was resolved in <a href=\"https://support.microsoft.com/help/4482887\" target=\"_blank\">KB4482887</a> and the upgrade block removed. </div><br><a href ='#160msg'>Back to top</a></td><td>OS Build 17763.134<br><br>November 13, 2018<br><a href ='https://support.microsoft.com/help/4467708' target='_blank'>KB4467708</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4482887' target='_blank'>KB4482887</a></td><td>Resolved:<br>March 01, 2019 <br>10:00 AM PT<br><br>Opened:<br>November 13, 2018 <br>10:00 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
@ -32,6 +32,12 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Date resolved</td></tr>
|
||||
<tr><td><div id='671msg'></div><b>Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error</b><br>Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.<br><br><a href = '#671msgdesc'>See details ></a></td><td>OS Build 18362.295<br><br>August 13, 2019<br><a href ='https://support.microsoft.com/help/4512508' target='_blank'>KB4512508</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='670msg'></div><b>Issues updating when certain versions of Intel storage drivers are installed</b><br>Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.<br><br><a href = '#670msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='669msg'></div><b>Initiating a Remote Desktop connection may result in black screen</b><br>When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.<br><br><a href = '#669msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='668msg'></div><b>Windows Sandbox may fail to start with error code “0x80070002”</b><br>Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates<br><br><a href = '#668msgdesc'>See details ></a></td><td>OS Build 18362.116<br><br>May 20, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='667msg'></div><b>Devices starting using PXE from a WDS or SCCM servers may fail to start</b><br>Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"<br><br><a href = '#667msgdesc'>See details ></a></td><td>OS Build 18362.175<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='666msg'></div><b>Domain connected devices that use MIT Kerberos realms will not start up</b><br>Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.<br><br><a href = '#666msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='610msg'></div><b>MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices</b><br>You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.<br><br><a href = '#610msgdesc'>See details ></a></td><td>OS Build 18362.175<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a></td><td>Resolved External<br></td><td>August 09, 2019 <br>07:03 PM PT</td></tr>
|
||||
<tr><td><div id='597msg'></div><b>Display brightness may not respond to adjustments</b><br>Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.<br><br><a href = '#597msgdesc'>See details ></a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4505903' target='_blank'>KB4505903</a></td><td>July 26, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='546msg'></div><b>RASMAN service may stop working and result in the error “0xc0000005”</b><br>The Remote Access Connection Manager (RASMAN) service may stop working and result in the error “0xc0000005” with VPN profiles configured as an Always On VPN connection.<br><br><a href = '#546msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4505903' target='_blank'>KB4505903</a></td><td>July 26, 2019 <br>02:00 PM PT</td></tr>
|
||||
@ -58,10 +64,24 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='671msgdesc'></div><b>Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error</b><div>After installing <a href='https://support.microsoft.com/help/4512508' target='_blank'>KB4512508</a>, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1</li><li>Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2</li></ul><div></div><div><strong>Resolution: </strong>This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>. The ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to <strong>Check for updates</strong> to receive <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a> and install. For instructions, see <a href=\"https://support.microsoft.com/help/4027667/windows-10-update\" target=\"_blank\">Update Windows 10</a>.</div><div><br></div><div><strong>Note</strong> Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).</div><br><a href ='#671msg'>Back to top</a></td><td>OS Build 18362.295<br><br>August 13, 2019<br><a href ='https://support.microsoft.com/help/4512508' target='_blank'>KB4512508</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>August 14, 2019 <br>03:34 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='610msgdesc'></div><b>MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices</b><div>You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (<a href='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a>) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1</li><li>Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2</li></ul><div></div><div><strong>Resolution:</strong> For guidance on this issue, see the Apple support article <a href=\"https://support.apple.com/HT210423\" target=\"_blank\">If your Mac can't use NTLM to connect to a Windows server</a>. There is no update for Windows needed for this issue.</div><br><a href ='#610msg'>Back to top</a></td><td>OS Build 18362.175<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a></td><td>Resolved External<br></td><td>Last updated:<br>August 09, 2019 <br>07:03 PM PT<br><br>Opened:<br>August 09, 2019 <br>04:25 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
- title: July 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='670msgdesc'></div><b>Issues updating when certain versions of Intel storage drivers are installed</b><div>Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903). </div><div><br></div><div>To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions<strong> 15.1.0.1002</strong> through version <strong>15.5.2.1053</strong> installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.</div><div><br></div><div>Versions <strong>15.5.2.1054 or later</strong> are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is <strong>15.9.8.1050</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li><li>Server: Windows Server, version 1903</li></ul><div></div><div><strong>Workaround:</strong> To mitigate this issue before the safeguard hold is removed, you will need to update the Intel RST drivers for your device to version <strong>15.5.2.1054 </strong>or a later. Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You can also download the latest Intel RST drivers directly from Intel at <a href=\"https://downloadcenter.intel.com/download/28997/Intel-Rapid-Storage-Technology-Intel-RST-User-Interface-and-Driver\" target=\"_blank\">Intel® Rapid Storage Technology (Intel® RST) User Interface and Driver</a>. Once your drivers are updated, you can restart the installation process for Windows 10, version 1903. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.</div><div><br></div><div><strong>Resolution: </strong>This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>. The safeguard hold is estimated to be removed in early September.</div><br><a href ='#670msg'>Back to top</a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>July 25, 2019 <br>06:10 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='669msgdesc'></div><b>Initiating a Remote Desktop connection may result in black screen</b><div>When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li><li>Server: Windows Server, version 1903</li></ul><div></div><div><strong>Resolution:</strong> This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>.</div><br><a href ='#669msg'>Back to top</a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>July 12, 2019 <br>04:42 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='667msgdesc'></div><b>Devices starting using PXE from a WDS or SCCM servers may fail to start</b><div>Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing <a href='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a> on a WDS server.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903</li></ul><div></div><div><strong>Resolution:</strong> This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>.</div><br><a href ='#667msg'>Back to top</a></td><td>OS Build 18362.175<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>July 10, 2019 <br>02:51 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='666msgdesc'></div><b>Domain connected devices that use MIT Kerberos realms will not start up</b><div>Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of <a href='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a>. Devices that are domain controllers or domain members are both affected.</div><div><br></div><div>To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.</div><div><br></div><div><strong>Note </strong>If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:</div><pre class=\"ql-syntax\" spellcheck=\"false\">HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
|
||||
</pre><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607</li><li>Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016</li></ul><div></div><div><strong>Resolution: </strong>This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>. The safeguard hold is estimated to be removed in early September.</div><br><a href ='#666msg'>Back to top</a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>July 25, 2019 <br>06:10 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
- title: June 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
@ -77,6 +97,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='668msgdesc'></div><b>Windows Sandbox may fail to start with error code “0x80070002”</b><div>Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li></ul><div></div><div><strong>Resolution:</strong> This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>.</div><br><a href ='#668msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 20, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 24, 2019 <br>04:20 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='597msgdesc'></div><b>Display brightness may not respond to adjustments</b><div>Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Windows 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.</div><div><br></div><div>To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li></ul><div></div><div><strong>Resolution: </strong>This issue was resolved in <a href='https://support.microsoft.com/help/4505903' target='_blank'>KB4505903</a> and the safeguard hold has been removed. Please ensure you have applied the resolving update before attempting to update to the Windows 10 May 2019 Update (version 1903). Please note, it can take up to 48 hours for the safeguard to be removed.</div><br><a href ='#597msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4505903' target='_blank'>KB4505903</a></td><td>Resolved:<br>July 26, 2019 <br>02:00 PM PT<br><br>Opened:<br>May 21, 2019 <br>07:56 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='533msgdesc'></div><b>Loss of functionality in Dynabook Smartphone Link app</b><div>Some users may experience a loss of functionality after updating to Windows 10, version 1903 when using the Dynabook Smartphone Link application on Windows devices. Loss of functionality may affect the display of phone numbers in the Call menu and the ability to answer phone calls on the Windows PC.</div><div><br></div><div>To safeguard your update experience, we have applied a compatibility hold on devices with Dynabook Smartphone Link from being offered Windows 10, version 1903, until this issue is resolved.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li></ul><div></div><div><strong>Resolution: </strong>This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.</div><br><a href ='#533msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 20, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>Resolved:<br>July 11, 2019 <br>01:54 PM PT<br><br>Opened:<br>May 24, 2019 <br>03:10 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='532msgdesc'></div><b>Error attempting to update with external USB device or memory card attached </b><div>If you have an external USB device or SD memory card attached when installing Windows 10, version 1903, you may get an error message stating \"This PC can't be upgraded to Windows 10.\" This is caused by inappropriate drive reassignment during installation.</div><div><br></div><div>Sample scenario: An update to Windows 10, version 1903 is attempted on a computer that has a thumb drive inserted into its USB port. Before the update, the thumb drive is mounted in the system as drive G based on the existing drive configuration. After the feature update is installed; however, the device is reassigned a different drive letter (e.g., drive H).</div><div><br></div><div><strong>Note</strong> The drive reassignment is not limited to removable drives. Internal hard drives may also be affected.</div><div><br></div><div>To safeguard your update experience, we have applied a hold on devices with an external USB device or SD memory card attached from being offered Windows 10, version 1903 until this issue is resolved.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li></ul><div></div><div><strong>Resolution: </strong>This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.</div><br><a href ='#532msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>Resolved:<br>July 11, 2019 <br>01:53 PM PT<br><br>Opened:<br>May 21, 2019 <br>07:38 AM PT</td></tr>
|
||||
|
||||
@ -65,6 +65,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "<div>This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.</div><br>
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Last updated</td></tr>
|
||||
<tr><td><div id='674msg'></div><b>Notification issue: \"Your device is missing important security and quality fixes.\"</b><br>Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"<br><br><a href = '#674msgdesc'>See details ></a></td><td>N/A <br><br><a href ='' target='_blank'></a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>September 03, 2019 <br>12:32 PM PT</td></tr>
|
||||
<tr><td><div id='650msg'></div><b>Devices starting using PXE from a WDS or SCCM servers may fail to start</b><br>Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"<br><br><a href = '#650msgdesc'>See details ></a></td><td>OS Build 17134.829<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503286' target='_blank'>KB4503286</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512509' target='_blank'>KB4512509</a></td><td>August 19, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='649msg'></div><b>Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error</b><br>Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.<br><br><a href = '#649msgdesc'>See details ></a></td><td>OS Build 17134.950<br><br>August 13, 2019<br><a href ='https://support.microsoft.com/help/4512501' target='_blank'>KB4512501</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512509' target='_blank'>KB4512509</a></td><td>August 19, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='628msg'></div><b>Domain connected devices that use MIT Kerberos realms will not start up</b><br>Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.<br><br><a href = '#628msgdesc'>See details ></a></td><td>OS Build 17134.915<br><br>July 16, 2019<br><a href ='https://support.microsoft.com/help/4507466' target='_blank'>KB4507466</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512501' target='_blank'>KB4512501</a></td><td>August 13, 2019 <br>10:00 AM PT</td></tr>
|
||||
@ -81,6 +82,15 @@ sections:
|
||||
<div>
|
||||
</div>
|
||||
"
|
||||
- title: September 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='674msgdesc'></div><b>Notification issue: \"Your device is missing important security and quality fixes.\"</b><div>Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1803</li><li>Server: Windows Server, version 1803</li></ul><div></div><div><strong>Resolution: </strong>This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting <strong>Check for Updates </strong>in the <strong>Windows Update </strong>dialog. For instructions, see <a href=\"https://support.microsoft.com/help/4027667/windows-10-update\" target=\"_blank\">Update Windows 10</a>. Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes. </div><br><a href ='#674msg'>Back to top</a></td><td>N/A <br><br><a href ='' target='_blank'></a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>Resolved:<br>September 03, 2019 <br>12:32 PM PT<br><br>Opened:<br>September 03, 2019 <br>12:32 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
- title: August 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
|
||||
@ -65,18 +65,17 @@ sections:
|
||||
- type: markdown
|
||||
text: "<div>This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.</div><br>
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Last updated</td></tr>
|
||||
<tr><td><div id='651msg'></div><b>Windows Sandbox may fail to start with error code “0x80070002”</b><br>Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates<br><br><a href = '#651msgdesc'>See details ></a></td><td>OS Build 18362.116<br><br>May 20, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Investigating<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 20, 2019 <br>11:06 AM PT</td></tr>
|
||||
<tr><td><div id='647msg'></div><b>Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error</b><br>Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.<br><br><a href = '#647msgdesc'>See details ></a></td><td>OS Build 18362.295<br><br>August 13, 2019<br><a href ='https://support.microsoft.com/help/4512508' target='_blank'>KB4512508</a></td><td>Investigating<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 17, 2019 <br>01:49 PM PT</td></tr>
|
||||
<tr><td><div id='671msg'></div><b>Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error</b><br>Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.<br><br><a href = '#671msgdesc'>See details ></a></td><td>OS Build 18362.295<br><br>August 13, 2019<br><a href ='https://support.microsoft.com/help/4512508' target='_blank'>KB4512508</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='670msg'></div><b>Issues updating when certain versions of Intel storage drivers are installed</b><br>Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.<br><br><a href = '#670msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='669msg'></div><b>Initiating a Remote Desktop connection may result in black screen</b><br>When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.<br><br><a href = '#669msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='668msg'></div><b>Windows Sandbox may fail to start with error code “0x80070002”</b><br>Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates<br><br><a href = '#668msgdesc'>See details ></a></td><td>OS Build 18362.116<br><br>May 20, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='667msg'></div><b>Devices starting using PXE from a WDS or SCCM servers may fail to start</b><br>Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"<br><br><a href = '#667msgdesc'>See details ></a></td><td>OS Build 18362.175<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='666msg'></div><b>Domain connected devices that use MIT Kerberos realms will not start up</b><br>Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.<br><br><a href = '#666msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 30, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='634msg'></div><b>Updates may fail to install and you may receive Error 0x80073701</b><br>Installation of updates may fail and you may receive an error, \"Updates Failed, There were problems installing some updates, but we'll try again later\" and \"Error 0x80073701.\"<br><br><a href = '#634msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Investigating<br><a href = '' target='_blank'></a></td><td>August 16, 2019 <br>04:28 PM PT</td></tr>
|
||||
<tr><td><div id='627msg'></div><b>Domain connected devices that use MIT Kerberos realms will not start up</b><br>Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.<br><br><a href = '#627msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Investigating<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>August 13, 2019 <br>06:59 PM PT</td></tr>
|
||||
<tr><td><div id='610msg'></div><b>MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices</b><br>You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.<br><br><a href = '#610msgdesc'>See details ></a></td><td>OS Build 18362.175<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a></td><td>Resolved External<br></td><td>August 09, 2019 <br>07:03 PM PT</td></tr>
|
||||
<tr><td><div id='608msg'></div><b>Issues updating when certain versions of Intel storage drivers are installed</b><br>Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.<br><br><a href = '#608msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Mitigated External<br></td><td>August 09, 2019 <br>07:03 PM PT</td></tr>
|
||||
<tr><td><div id='603msg'></div><b>Intermittent loss of Wi-Fi connectivity</b><br>Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. <br><br><a href = '#603msgdesc'>See details ></a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Mitigated External<br></td><td>August 01, 2019 <br>08:44 PM PT</td></tr>
|
||||
<tr><td><div id='601msg'></div><b>Gamma ramps, color profiles, and night light settings do not apply in some cases</b><br>Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.<br><br><a href = '#601msgdesc'>See details ></a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>August 01, 2019 <br>06:27 PM PT</td></tr>
|
||||
<tr><td><div id='597msg'></div><b>Display brightness may not respond to adjustments</b><br>Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.<br><br><a href = '#597msgdesc'>See details ></a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4505903' target='_blank'>KB4505903</a></td><td>July 26, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='536msg'></div><b>The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU</b><br>Some apps or games that needs to perform graphics intensive operations may close or fail to open on Surface Book 2 devices with Nvidia dGPU.<br><br><a href = '#536msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Investigating<br><a href = '' target='_blank'></a></td><td>July 16, 2019 <br>09:04 AM PT</td></tr>
|
||||
<tr><td><div id='534msg'></div><b>Initiating a Remote Desktop connection may result in black screen</b><br>When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.<br><br><a href = '#534msgdesc'>See details ></a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Investigating<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>July 12, 2019 <br>04:42 PM PT</td></tr>
|
||||
<tr><td><div id='530msg'></div><b>Devices starting using PXE from a WDS or SCCM servers may fail to start</b><br>Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"<br><br><a href = '#530msgdesc'>See details ></a></td><td>OS Build 18362.175<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a></td><td>Mitigated<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>July 10, 2019 <br>07:09 PM PT</td></tr>
|
||||
<tr><td><div id='450msg'></div><b>Unable to discover or connect to Bluetooth devices</b><br>Microsoft has identified compatibility issues with some versions of Realtek and Qualcomm Bluetooth radio drivers.<br><br><a href = '#450msgdesc'>See details ></a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>May 21, 2019 <br>04:48 PM PT</td></tr>
|
||||
<tr><td><div id='447msg'></div><b>Intel Audio displays an intcdaud.sys notification</b><br>Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in battery drain. <br><br><a href = '#447msgdesc'>See details ></a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>May 21, 2019 <br>04:47 PM PT</td></tr>
|
||||
<tr><td><div id='446msg'></div><b>Cannot launch Camera app </b><br>Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.<br><br><a href = '#446msgdesc'>See details ></a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>May 21, 2019 <br>04:47 PM PT</td></tr>
|
||||
@ -95,7 +94,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='647msgdesc'></div><b>Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error</b><div>After installing <a href='https://support.microsoft.com/help/4512508' target='_blank'>KB4512508</a>, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1</li><li>Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2</li></ul><div></div><div><strong>Next steps: </strong>Microsoft is working on a resolution and estimates a solution will be available late August. The ‘optional’ update will be available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to <strong>Check for updates</strong> to receive the update once it is released.</div><div><br></div><div><strong>Note</strong> Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).</div><br><a href ='#647msg'>Back to top</a></td><td>OS Build 18362.295<br><br>August 13, 2019<br><a href ='https://support.microsoft.com/help/4512508' target='_blank'>KB4512508</a></td><td>Investigating<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Last updated:<br>August 17, 2019 <br>01:49 PM PT<br><br>Opened:<br>August 14, 2019 <br>03:34 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='671msgdesc'></div><b>Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error</b><div>After installing <a href='https://support.microsoft.com/help/4512508' target='_blank'>KB4512508</a>, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1</li><li>Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2</li></ul><div></div><div><strong>Resolution: </strong>This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>. The ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to <strong>Check for updates</strong> to receive <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a> and install. For instructions, see <a href=\"https://support.microsoft.com/help/4027667/windows-10-update\" target=\"_blank\">Update Windows 10</a>.</div><div><br></div><div><strong>Note</strong> Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).</div><br><a href ='#671msg'>Back to top</a></td><td>OS Build 18362.295<br><br>August 13, 2019<br><a href ='https://support.microsoft.com/help/4512508' target='_blank'>KB4512508</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>August 14, 2019 <br>03:34 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='634msgdesc'></div><b>Updates may fail to install and you may receive Error 0x80073701</b><div>Installation of updates may fail and you may receive the error message, \"Updates Failed, There were problems installing some updates, but we'll try again later\" or \"Error 0x80073701\" on the <strong>Windows Update</strong> dialog or within U<strong>pdate history</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li><li>Server: Windows Server, version 1903</li></ul><div></div><div><strong>Next steps: </strong>We are working on a resolution and will provide an update in an upcoming release.</div><br><a href ='#634msg'>Back to top</a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Investigating<br><a href = '' target='_blank'></a></td><td>Last updated:<br>August 16, 2019 <br>04:28 PM PT<br><br>Opened:<br>August 16, 2019 <br>01:41 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='610msgdesc'></div><b>MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices</b><div>You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (<a href='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a>) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1</li><li>Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2</li></ul><div></div><div><strong>Resolution:</strong> For guidance on this issue, see the Apple support article <a href=\"https://support.apple.com/HT210423\" target=\"_blank\">If your Mac can't use NTLM to connect to a Windows server</a>. There is no update for Windows needed for this issue.</div><br><a href ='#610msg'>Back to top</a></td><td>OS Build 18362.175<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a></td><td>Resolved External<br></td><td>Last updated:<br>August 09, 2019 <br>07:03 PM PT<br><br>Opened:<br>August 09, 2019 <br>04:25 PM PT</td></tr>
|
||||
</table>
|
||||
@ -106,12 +105,12 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='627msgdesc'></div><b>Domain connected devices that use MIT Kerberos realms will not start up</b><div>Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of <a href='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a>. Devices that are domain controllers or domain members are both affected.</div><div><br></div><div>To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.</div><div><br></div><div><strong>Note </strong>If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:</div><pre class=\"ql-syntax\" spellcheck=\"false\">HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
|
||||
</pre><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607</li><li>Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016</li></ul><div></div><div><strong>Next steps:</strong> At this time, we suggest that devices in an affected environment do not install <a href='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a>. We are working on a resolution and estimate a solution will be available in late August.</div><div><br></div><div><strong>Note</strong> We recommend that you do not attempt to manually update using the <strong>Update now</strong> button or the Media Creation Tool until this issue has been resolved.</div><br><a href ='#627msg'>Back to top</a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Investigating<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Last updated:<br>August 13, 2019 <br>06:59 PM PT<br><br>Opened:<br>July 25, 2019 <br>06:10 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='608msgdesc'></div><b>Issues updating when certain versions of Intel storage drivers are installed</b><div>Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903). </div><div><br></div><div>To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions<strong> 15.1.0.1002</strong> through version <strong>15.5.2.1053</strong> installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.</div><div><br></div><div>Versions <strong>15.5.2.1054 or later</strong> are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is <strong>15.9.8.1050</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li><li>Server: Windows Server, version 1903</li></ul><div></div><div><strong>Workaround:</strong> To mitigate this issue before the resolution is released, you will need to update the Intel RST drivers for your device to version <strong>15.5.2.1054 </strong>or a later. Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You can also download the latest Intel RST drivers directly from Intel at <a href=\"https://downloadcenter.intel.com/download/28997/Intel-Rapid-Storage-Technology-Intel-RST-User-Interface-and-Driver\" target=\"_blank\">Intel® Rapid Storage Technology (Intel® RST) User Interface and Driver</a>. Once your drivers are updated, you can restart the installation process for Windows 10, version 1903. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.</div><div><br></div><div><strong>Note</strong> Until an updated driver has been installed, we recommend you do not attempt to manually update using the <strong>Update now </strong>button or the Media Creation Tool. </div><div><br></div><div><strong>Next Steps: </strong>We are working on a resolution and estimate a solution will be available in late August.</div><br><a href ='#608msg'>Back to top</a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Mitigated External<br></td><td>Last updated:<br>August 09, 2019 <br>07:03 PM PT<br><br>Opened:<br>July 25, 2019 <br>06:10 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='670msgdesc'></div><b>Issues updating when certain versions of Intel storage drivers are installed</b><div>Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903). </div><div><br></div><div>To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions<strong> 15.1.0.1002</strong> through version <strong>15.5.2.1053</strong> installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.</div><div><br></div><div>Versions <strong>15.5.2.1054 or later</strong> are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is <strong>15.9.8.1050</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li><li>Server: Windows Server, version 1903</li></ul><div></div><div><strong>Workaround:</strong> To mitigate this issue before the safeguard hold is removed, you will need to update the Intel RST drivers for your device to version <strong>15.5.2.1054 </strong>or a later. Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You can also download the latest Intel RST drivers directly from Intel at <a href=\"https://downloadcenter.intel.com/download/28997/Intel-Rapid-Storage-Technology-Intel-RST-User-Interface-and-Driver\" target=\"_blank\">Intel® Rapid Storage Technology (Intel® RST) User Interface and Driver</a>. Once your drivers are updated, you can restart the installation process for Windows 10, version 1903. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.</div><div><br></div><div><strong>Resolution: </strong>This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>. The safeguard hold is estimated to be removed in early September.</div><br><a href ='#670msg'>Back to top</a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>July 25, 2019 <br>06:10 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='669msgdesc'></div><b>Initiating a Remote Desktop connection may result in black screen</b><div>When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li><li>Server: Windows Server, version 1903</li></ul><div></div><div><strong>Resolution:</strong> This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>.</div><br><a href ='#669msg'>Back to top</a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>July 12, 2019 <br>04:42 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='667msgdesc'></div><b>Devices starting using PXE from a WDS or SCCM servers may fail to start</b><div>Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing <a href='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a> on a WDS server.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903</li></ul><div></div><div><strong>Resolution:</strong> This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>.</div><br><a href ='#667msg'>Back to top</a></td><td>OS Build 18362.175<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>July 10, 2019 <br>02:51 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='666msgdesc'></div><b>Domain connected devices that use MIT Kerberos realms will not start up</b><div>Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of <a href='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a>. Devices that are domain controllers or domain members are both affected.</div><div><br></div><div>To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.</div><div><br></div><div><strong>Note </strong>If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:</div><pre class=\"ql-syntax\" spellcheck=\"false\">HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
|
||||
</pre><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607</li><li>Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016</li></ul><div></div><div><strong>Resolution: </strong>This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>. The safeguard hold is estimated to be removed in early September.</div><br><a href ='#666msg'>Back to top</a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>July 25, 2019 <br>06:10 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='536msgdesc'></div><b>The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU</b><div>Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing unit (dGPU). After updating to Windows 10, version 1903 (May 2019 Feature Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.</div><div><br></div><div>To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPUs from being offered Windows 10, version 1903, until this issue is resolved.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li></ul><div></div><div><strong>Workaround:</strong> To mitigate the issue if you are already on Windows 10, version 1903, you can restart the device or select the <strong>Scan for hardware changes</strong> button in the <strong>Action </strong>menu or on the toolbar in Device Manager.</div><div><br></div><div><strong>Note</strong> We recommend that you do not attempt to manually update using the <strong>Update now</strong> button or the Media Creation Tool until this issue has been resolved.</div><div><br></div><div><strong>Next steps: </strong>We are working on a resolution and will provide an update in an upcoming release.</div><br><a href ='#536msg'>Back to top</a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Investigating<br><a href = '' target='_blank'></a></td><td>Last updated:<br>July 16, 2019 <br>09:04 AM PT<br><br>Opened:<br>July 12, 2019 <br>04:20 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='534msgdesc'></div><b>Initiating a Remote Desktop connection may result in black screen</b><div>When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li><li>Server: Windows Server, version 1903</li></ul><div></div><div><strong>Next steps: </strong>We are working on a resolution that will be made available in upcoming release.</div><br><a href ='#534msg'>Back to top</a></td><td>OS Build 18362.145<br><br>May 29, 2019<br><a href ='https://support.microsoft.com/help/4497935' target='_blank'>KB4497935</a></td><td>Investigating<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Last updated:<br>July 12, 2019 <br>04:42 PM PT<br><br>Opened:<br>July 12, 2019 <br>04:42 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='530msgdesc'></div><b>Devices starting using PXE from a WDS or SCCM servers may fail to start</b><div>Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing <a href='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a> on a WDS server.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903</li></ul><div></div><div><strong>Workaround: </strong></div><div>To mitigate this issue on an SCCM server:</div><ol><li>Verify Variable Window Extension is enabled.</li><li>Set the values of <strong>TFTP block size </strong>to <strong>4096</strong> and <strong>TFTP window size </strong>to <strong>1</strong>. For guidance on how to configure them<strong>, </strong>see <a href=\"https://docs.microsoft.com/en-us/sccm/osd/get-started/prepare-site-system-roles-for-operating-system-deployments#BKMK_RamDiskTFTP\" target=\"_blank\">Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points</a>.</li></ol><div><strong>Note </strong>Try the default values for <strong>TFTP block size </strong>and <strong>TFTP window size </strong>first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the <strong>Enable a PXE responder without Windows Deployment Service</strong> setting. For more information on this setting, see <a href=\"https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_config-pxe\" target=\"_blank\">Install and configure distribution points in Configuration Manager</a>.</div><div><br></div><div>To mitigate this issue on a WDS server without SCCM:</div><ol><li>In WDS TFTP settings, verify Variable Window Extension is enabled.</li><li>In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.</li><li>In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.</li></ol><div><strong>Note </strong>Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.</div><div><br></div><div><strong>Next steps: </strong>We are working on a resolution and will provide an update in an upcoming release.</div><br><a href ='#530msg'>Back to top</a></td><td>OS Build 18362.175<br><br>June 11, 2019<br><a href ='https://support.microsoft.com/help/4503293' target='_blank'>KB4503293</a></td><td>Mitigated<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Last updated:<br>July 10, 2019 <br>07:09 PM PT<br><br>Opened:<br>July 10, 2019 <br>02:51 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
@ -120,10 +119,9 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='651msgdesc'></div><b>Windows Sandbox may fail to start with error code “0x80070002”</b><div>Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li></ul><div></div><div><strong>Next steps: </strong>We are working on a resolution and estimates a solution will be available in late August.</div><br><a href ='#651msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 20, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Investigating<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Last updated:<br>August 20, 2019 <br>11:06 AM PT<br><br>Opened:<br>May 24, 2019 <br>04:20 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='668msgdesc'></div><b>Windows Sandbox may fail to start with error code “0x80070002”</b><div>Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li></ul><div></div><div><strong>Resolution:</strong> This issue was resolved in <a href='https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a>.</div><br><a href ='#668msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 20, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4512941' target='_blank'>KB4512941</a></td><td>Resolved:<br>August 30, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 24, 2019 <br>04:20 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='603msgdesc'></div><b>Intermittent loss of Wi-Fi connectivity</b><div>Some older computers may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).</div><div><br></div><div>To safeguard your upgrade experience, we have applied a hold on devices with this Qualcomm driver from being offered Windows 10, version 1903, until the updated driver is installed.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li></ul><div></div><div><strong>Workaround: </strong>Before updating to Windows 10, version 1903, you will need to download and install an updated Wi-Fi driver from your device manufacturer (OEM).</div><div> </div><div><strong>Note</strong> We recommend that you do not attempt to manually update using the <strong>Update now</strong> button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.</div><br><a href ='#603msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Mitigated External<br></td><td>Last updated:<br>August 01, 2019 <br>08:44 PM PT<br><br>Opened:<br>May 21, 2019 <br>07:13 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='601msgdesc'></div><b>Gamma ramps, color profiles, and night light settings do not apply in some cases</b><div>Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.</div><div><br></div><div>Microsoft has identified some scenarios in which these features may have issues or stop working, for example:</div><ul><li>Connecting to (or disconnecting from) an external monitor, dock, or projector</li><li>Rotating the screen</li><li>Updating display drivers or making other display mode changes</li><li>Closing full screen applications</li><li>Applying custom color profiles</li><li>Running applications that rely on custom gamma ramps</li></ul><div></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li></ul><div></div><div><strong>Workaround: </strong>If you find that your night light has stopped working, try turning the night light off and on, or restarting your computer. For other color setting issues, restart your computer to correct the issue.</div><div><br></div><div><strong>Note </strong>We recommend that you do not attempt to manually update using the <strong>Update now</strong> button or the Media Creation Tool until this issue has been resolved.</div><div><br></div><div><strong>Next steps: </strong>We are working on a resolution and will provide an update in an upcoming release.</div><br><a href ='#601msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>Last updated:<br>August 01, 2019 <br>06:27 PM PT<br><br>Opened:<br>May 21, 2019 <br>07:28 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='597msgdesc'></div><b>Display brightness may not respond to adjustments</b><div>Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Windows 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.</div><div><br></div><div>To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li></ul><div></div><div><strong>Resolution: </strong>This issue was resolved in <a href='https://support.microsoft.com/help/4505903' target='_blank'>KB4505903</a> and the safeguard hold has been removed. Please ensure you have applied the resolving update before attempting to update to the Windows 10 May 2019 Update (version 1903). Please note, it can take up to 48 hours for the safeguard to be removed.</div><br><a href ='#597msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4505903' target='_blank'>KB4505903</a></td><td>Resolved:<br>July 26, 2019 <br>02:00 PM PT<br><br>Opened:<br>May 21, 2019 <br>07:56 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='450msgdesc'></div><b>Unable to discover or connect to Bluetooth devices</b><div>Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek and Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek or Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li><li>Server: Windows Server, version 1903</li></ul><div></div><div><strong>Workaround: </strong>Check with your device manufacturer (OEM) to see if an updated driver is available and install it.</div><div><br></div><ul><li>For Qualcomm drivers, you will need to install a driver version greater than 10.0.1.11.</li><li>For Realtek drivers, you will need to install a driver version greater than 1.5.1011.0.</li></ul><div></div><div><strong>Note</strong> Until an updated driver has been installed, we recommend you do not attempt to manually update using the<strong> Update now </strong>button or the Media Creation Tool. </div><div><br></div><div><strong>Next steps: </strong>Microsoft is working with Realtek and Qualcomm to release new drivers for all affected system via Windows Update.<strong> </strong> </div><div><br></div><br><a href ='#450msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>Last updated:<br>May 21, 2019 <br>04:48 PM PT<br><br>Opened:<br>May 21, 2019 <br>07:29 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='447msgdesc'></div><b>Intel Audio displays an intcdaud.sys notification</b><div>Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an <strong>intcdaud.sys</strong> notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).</div><div> </div><div>To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903; Windows 10, version 1809</li></ul><div></div><div><strong>Workaround:</strong></div><div>On the “What needs your attention\" notification, click the <strong>Back </strong>button to remain on your current version of Windows 10. (Do not click <strong>Confirm</strong> as this will proceed with the update and you may experience compatibility issues.) Affected devices will automatically revert to the previous working configuration.</div><div><br></div><div>For more information, see <a href=\"https://www.intel.com/content/www/us/en/support/articles/000030792/graphics-drivers.html\" target=\"_blank\" style=\"\">Intel's customer support guidance</a> and the Microsoft knowledge base article <a href=\"https://support.microsoft.com/help/4465877\" target=\"_blank\" style=\"\">KB4465877</a>.</div><div><br></div><div><strong>Note</strong> We recommend you do not attempt to update your devices until newer device drivers are installed.</div><div><br></div><div><strong>Next steps: </strong>You can opt to wait for newer drivers to be installed automatically through Windows Update or check with the computer manufacturer for the latest device driver software availability and installation procedures.</div><br><a href ='#447msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>Last updated:<br>May 21, 2019 <br>04:47 PM PT<br><br>Opened:<br>May 21, 2019 <br>07:22 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='446msgdesc'></div><b>Cannot launch Camera app </b><div>Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:</div><p class=\"ql-indent-1\">\"Close other apps, error code: 0XA00F4243.”</div><div><br></div><div>To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1903</li></ul><div></div><div><strong>Workaround: </strong>To temporarily resolve this issue, perform one of the following:</div><div><br></div><ul><li>Unplug your camera and plug it back in.</li></ul><p class=\"ql-indent-1\">or</div><ul><li>Disable and re-enable the driver in Device Manager. In the Search box, type \"Device Manager\" and press <strong>Enter</strong>. In the Device Manager dialog box, expand <strong>Cameras</strong>, then right-click on any <strong>RealSense</strong> driver listed and select <strong>Disable device</strong>. Right click on the driver again and select <strong>Enable device</strong>.</li></ul><p class=\"ql-indent-1\">or</div><ul><li>Restart the <strong>RealSense </strong>service. In the Search box, type \"Task Manager\" and hit <strong>Enter</strong>. In the Task Manager dialog box, click on the <strong>Services </strong>tab, right-click on <strong>RealSense</strong>, and select <strong>Restart</strong>. </li></ul><div></div><div><strong>Note </strong>This workaround will only resolve the issue until your next system restart.</div><div><br></div><div><strong>Note </strong>We recommend that you do not attempt to manually update using the <strong>Update now</strong> button or the Media Creation Tool until this issue has been resolved.</div><div><br></div><div><strong>Next steps: </strong>We are working on a resolution and will provide an update in an upcoming release.</div><br><a href ='#446msg'>Back to top</a></td><td>OS Build 18362.116<br><br>May 21, 2019<br><a href ='https://support.microsoft.com/help/4505057' target='_blank'>KB4505057</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>Last updated:<br>May 21, 2019 <br>04:47 PM PT<br><br>Opened:<br>May 21, 2019 <br>07:20 AM PT</td></tr>
|
||||
|
||||
@ -50,6 +50,8 @@ sections:
|
||||
text: "
|
||||
<table border ='0'><tr><td width='80%'>Message</td><td width='20%'>Date</td></tr>
|
||||
|
||||
<tr><td><a href = 'https://support.microsoft.com/help/4512941' target='_blank'><b>Status update: Windows 10, version 1903 \"D\" optional release available August 30th</b></a><br><div>The August optional monthly “D” release for Windows 10, version 1903 is now available. Follow <a href=\"https://twitter.com/windowsupdate\" target=\"_blank\">@WindowsUpdate</a> for the latest on the availability of this release.</div></td><td>August 30, 2019 <br>08:00 AM PT</td></tr>
|
||||
<tr><td><b>Feature update install notification on Windows 10, version 1809 (the October 2018 Update)</b><br><div>We've had reports on August 29th that some customers running Windows 10, version 1809 (the October 2018 Update) have received notification to install the latest feature update (version 1903) early. Updating remains in your control. To install the update, you must select one of the following options: \"Pick a Time\", \"Restart Tonight,\" or \"Restart Now\". If you are not ready to update at this time, simply dismiss the notification by clicking the arrow in the top right corner. If you have updated to Windows 10, version 1903 and would like to go back to your previous version, see the instructions <a href=\"https://support.microsoft.com/help/12415/windows-10-recovery-options#section6\" target=\"_blank\">here</a>.</div></td><td>August 29, 2019 <br>04:39 PM PT</td></tr>
|
||||
<tr><td><a href = 'https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Bringing-Internet-Explorer-11-to-Windows-Server-2012-and-Windows/ba-p/325297' target='_blank'><b>Take Action: Internet Explorer 11 now available on Windows Update/WSUS for Windows Server 2012 and Windows Embedded 8 Standard</b></a><br><div>Internet Explorer 11 (<a href=\"https://support.microsoft.com/help/4492872\" target=\"_blank\">KB 4492872</a>) is now available via Windows Update (WU) and Windows Server Update Services (WSUS) for commercial customers running Windows Server 2012 and Windows Embedded 8 Standard. For details about these changes and end of support for IE10, please refer to the <a href=\"https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Bringing-Internet-Explorer-11-to-Windows-Server-2012-and-Windows/ba-p/325297\" target=\"_blank\">IT Pro blog</a>. </div></td><td>August 29, 2019 <br>08:00 AM PT</td></tr>
|
||||
<tr><td><a href = 'https://support.microsoft.com/help/4472027' target='_blank'><b>Take action: SHA-2 code signing support guidance for Windows 7 SP1 and Windows Server 2008 RS2 SP1</b></a><br><div>Windows 7 SP1 and Windows Server 2008 R2 SP1 update signatures are now SHA-2 based signatures and requires that SHA-2 support to be installed. For important customer guidance on installation and troubleshooting tips, please read the knowledge base article <a href=\"https://support.microsoft.com/help/4472027\" target=\"_blank\">2019 SHA-2 Code Signing Support requirement for Windows and WSUS</a>.</div></td><td>August 23, 2019 <br>03:35 PM PT</td></tr>
|
||||
<tr><td><b>Take action: Windows 10, version 1703 (the Windows 10 Creators Update) reaches end of life on October 9, 2019 </b><br><div>The Enterprise and Education editions of Windows 10, version 1703 (the Windows 10 Creators Update) will reach end of life on October 9, 2019. The Home, Pro, Pro for Workstations, and IoT Core editions reached end of service on October 8, 2018.</div><div><br></div><div>There is no extended support available for any edition of Windows 10, version 1703. Therefore, it will no longer be supported after October 9, 2019 and will not receive monthly security and quality updates containing protections from the latest security threats.</div><div><br></div><div>To continue receiving security and quality updates, Microsoft recommends that you update your devices to the latest version of Windows 10. For more information on end of service dates and currently supported versions of Windows 10, see the <a href=\"https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet\" target=\"_blank\">Windows lifecycle fact sheet</a>.</div></td><td>August 23, 2019 <br>02:17 PM PT</td></tr>
|
||||
|
||||
@ -398,7 +398,6 @@
|
||||
####### [Get domain related alerts](microsoft-defender-atp/get-domain-related-alerts.md)
|
||||
####### [Get domain related machines](microsoft-defender-atp/get-domain-related-machines.md)
|
||||
####### [Get domain statistics](microsoft-defender-atp/get-domain-statistics.md)
|
||||
####### [Is domain seen in organization (Deprecated)](microsoft-defender-atp/is-domain-seen-in-org.md)
|
||||
|
||||
###### [File]()
|
||||
####### [File methods and properties](microsoft-defender-atp/files.md)
|
||||
@ -409,9 +408,7 @@
|
||||
|
||||
###### [IP]()
|
||||
####### [Get IP related alerts](microsoft-defender-atp/get-ip-related-alerts.md)
|
||||
####### [Get IP related machines (Deprecated)](microsoft-defender-atp/get-ip-related-machines.md)
|
||||
####### [Get IP statistics](microsoft-defender-atp/get-ip-statistics.md)
|
||||
####### [Is IP seen in organization (Deprecated)](microsoft-defender-atp/is-ip-seen-org.md)
|
||||
|
||||
###### [User]()
|
||||
####### [User methods](microsoft-defender-atp/user.md)
|
||||
@ -440,13 +437,13 @@
|
||||
##### [Experiment with custom threat intelligence alerts (Deprecated)](microsoft-defender-atp/experiment-custom-ti.md)
|
||||
##### [Troubleshoot custom threat intelligence issues (Deprecated)](microsoft-defender-atp/troubleshoot-custom-ti.md)
|
||||
|
||||
#### [Pull alerts to your SIEM tools]()
|
||||
##### [Learn about different ways to pull alerts](microsoft-defender-atp/configure-siem.md)
|
||||
#### [Pull detections to your SIEM tools]()
|
||||
##### [Learn about different ways to pull detections](microsoft-defender-atp/configure-siem.md)
|
||||
##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md)
|
||||
##### [Configure Splunk to pull alerts](microsoft-defender-atp/configure-splunk.md)
|
||||
##### [Configure HP ArcSight to pull alerts](microsoft-defender-atp/configure-arcsight.md)
|
||||
##### [Microsoft Defender ATP SIEM alert API fields](microsoft-defender-atp/api-portal-mapping.md)
|
||||
##### [Pull alerts using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md)
|
||||
##### [Configure Splunk to pull detections](microsoft-defender-atp/configure-splunk.md)
|
||||
##### [Configure HP ArcSight to pull detections](microsoft-defender-atp/configure-arcsight.md)
|
||||
##### [Microsoft Defender ATP detection fields](microsoft-defender-atp/api-portal-mapping.md)
|
||||
##### [Pull detections using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md)
|
||||
##### [Troubleshoot SIEM tool integration issues](microsoft-defender-atp/troubleshoot-siem.md)
|
||||
|
||||
#### [Reporting]()
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 2.1 KiB After Width: | Height: | Size: 1.2 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 26 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 25 KiB |
@ -26,7 +26,7 @@ Microsoft Defender Advanced Threat Protection ([Microsoft Defender ATP](https://
|
||||
|
||||
Windows Defender Antivirus is the [next generation protection](https://www.youtube.com/watch?v=Xy3MOxkX_o4) capability in the Microsoft Defender ATP security stack which addresses the latest and most sophisticated threats today. In some cases, customers might not even know they were protected because a cyberattack is stopped [milliseconds after a campaign starts](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign?ocid=cx-docs-avreports). That's because Windows Defender Antivirus detects and stops malware at first sight by using [machine learning](https://cloudblogs.microsoft.com/microsoftsecure/2018/06/07/machine-learning-vs-social-engineering?ocid=cx-docs-avreports), [artificial intelligence](https://cloudblogs.microsoft.com/microsoftsecure/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak?ocid=cx-docs-avreports), behavioral analysis, and other advanced technologies.
|
||||
<br><br>
|
||||
|
||||
|
||||
|
||||
**Download the latest transparency report: [Examining industry test results, August 2019](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl)**
|
||||
|
||||
@ -48,10 +48,6 @@ The AV-TEST Product Review and Certification Report tests on three categories: p
|
||||
|
||||
- July - August 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/august-2018/microsoft-windows-defender-antivirus-4.12--4.18-183212/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2IL3Y)
|
||||
|
||||
|||
|
||||
|---|---|
|
||||
|||
|
||||
|
||||
### AV-Comparatives: Protection rating of 99.9% in the latest test
|
||||
|
||||
Business Security Test consists of three main parts: the Real-World Protection Test which mimics online malware attacks, the Malware Protection Test where the malware enters the system from outside the internet (e.g. USB), and the Performance Test which looks at the impact on the system’s performance.
|
||||
@ -64,9 +60,7 @@ Business Security Test consists of three main parts: the Real-World Protection T
|
||||
|
||||
- Business Security Test 2018 (March - June): [Real-World Protection Rate 98.7%](https://www.av-comparatives.org/tests/business-security-test-2018-march-june/)
|
||||
|
||||
|
||||
|
||||
### SE Labs: Total accuracy rating of AAA in the latest test
|
||||
### SE Labs: AAA award in the latest test
|
||||
|
||||
SE Labs tests a range of solutions used by products and services to detect and/or protect against attacks, including endpoint software, network appliances, and cloud services.
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Microsoft Defender ATP alert API fields
|
||||
description: Understand how the alert API fields map to the values in Microsoft Defender Security Center
|
||||
keywords: alerts, alert fields, fields, api, fields, pull alerts, rest api, request, response
|
||||
title: Microsoft Defender ATP detections API fields
|
||||
description: Understand how the Detections API fields map to the values in Microsoft Defender Security Center
|
||||
keywords: detections, detections fields, fields, api, fields, pull Detections, rest api, request, response
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -15,10 +15,9 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/16/2017
|
||||
---
|
||||
|
||||
# Microsoft Defender ATP SIEM alert API fields
|
||||
# Microsoft Defender ATP detections API fields
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -26,10 +25,14 @@ ms.date: 10/16/2017
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink)
|
||||
|
||||
Understand what data fields are exposed as part of the alerts API and how they map to Microsoft Defender Security Center.
|
||||
Understand what data fields are exposed as part of the detections API and how they map to Microsoft Defender Security Center.
|
||||
|
||||
## Alert API fields and portal mapping
|
||||
The following table lists the available fields exposed in the alerts API payload. It shows examples for the populated values and a reference on how data is reflected on the portal.
|
||||
>[!Note]
|
||||
>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections
|
||||
>- **Microsoft Defender ATP Detection** is composed from the suspicious event occurred on the Machine and its related **Alert** details.
|
||||
|
||||
## Detections API fields and portal mapping
|
||||
The following table lists the available fields exposed in the detections API payload. It shows examples for the populated values and a reference on how data is reflected on the portal.
|
||||
|
||||
The ArcSight field column contains the default mapping between the Microsoft Defender ATP fields and the built-in fields in ArcSight. You can download the mapping file from the portal when you enable the SIEM integration feature and you can modify it to match the needs of your organization. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md).
|
||||
|
||||
@ -39,33 +42,33 @@ Field numbers match the numbers in the images below.
|
||||
>
|
||||
> | Portal label | SIEM field name | ArcSight field | Example value | Description |
|
||||
> |------------------|---------------------------|---------------------|------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
> | 1 | AlertTitle | name | Windows Defender AV detected 'Mikatz' high-severity malware | Value available for every alert. |
|
||||
> | 2 | Severity | deviceSeverity | High | Value available for every alert. |
|
||||
> | 3 | Category | deviceEventCategory | Malware | Value available for every alert. |
|
||||
> | 4 | Detection source | sourceServiceName | Antivirus | Windows Defender Antivirus or Microsoft Defender ATP. Value available for every alert. |
|
||||
> | 5 | MachineName | sourceHostName | desktop-4a5ngd6 | Value available for every alert. |
|
||||
> | 6 | FileName | fileName | Robocopy.exe | Available for alerts associated with a file or process. |
|
||||
> | 7 | FilePath | filePath | C:\Windows\System32\Robocopy.exe | Available for alerts associated with a file or process. |
|
||||
> | 8 | UserDomain | sourceNtDomain | CONTOSO | The domain of the user context running the activity, available for Microsoft Defender ATP behavioral based alerts. |
|
||||
> | 9 | UserName | sourceUserName | liz.bean | The user context running the activity, available for Microsoft Defender ATP behavioral based alerts. |
|
||||
> | 10 | Sha1 | fileHash | 3da065e07b990034e9db7842167f70b63aa5329 | Available for alerts associated with a file or process. |
|
||||
> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Windows Defender AV alerts. |
|
||||
> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Windows Defender AV alerts. |
|
||||
> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Windows Defender AV alerts. |
|
||||
> | 14 | IpAddress | sourceAddress | 218.90.204.141 | Available for alerts associated to network events. For example, 'Communication to a malicious network destination'. |
|
||||
> | 15 | Url | requestUrl | down.esales360.cn | Available for alerts associated to network events. For example, 'Communication to a malicious network destination'. |
|
||||
> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE. |
|
||||
> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE. |
|
||||
> | 18 | AlertId | externalId | 636210704265059241_673569822 | Value available for every alert. |
|
||||
> | 19 | LinkToWDATP | flexString1 | `https://securitycenter.windows.com/alert/636210704265059241_673569822` | Value available for every alert. |
|
||||
> | 20 | AlertTime | deviceReceiptTime | 2017-05-07T01:56:59.3191352Z | The time the activity relevant to the alert occurred. Value available for every alert. |
|
||||
> | 21 | MachineDomain | sourceDnsDomain | contoso.com | Domain name not relevant for AAD joined machines. Value available for every alert. |
|
||||
> | 1 | AlertTitle | name | Windows Defender AV detected 'Mikatz' high-severity malware | Value available for every Detection. |
|
||||
> | 2 | Severity | deviceSeverity | High | Value available for every Detection. |
|
||||
> | 3 | Category | deviceEventCategory | Malware | Value available for every Detection. |
|
||||
> | 4 | Detection source | sourceServiceName | Antivirus | Windows Defender Antivirus or Microsoft Defender ATP. Value available for every Detection. |
|
||||
> | 5 | MachineName | sourceHostName | desktop-4a5ngd6 | Value available for every Detection. |
|
||||
> | 6 | FileName | fileName | Robocopy.exe | Available for detections associated with a file or process. |
|
||||
> | 7 | FilePath | filePath | C:\Windows\System32\Robocopy.exe | Available for detections associated with a file or process. |
|
||||
> | 8 | UserDomain | sourceNtDomain | CONTOSO | The domain of the user context running the activity, available for Microsoft Defender ATP behavioral based detections. |
|
||||
> | 9 | UserName | sourceUserName | liz.bean | The user context running the activity, available for Microsoft Defender ATP behavioral based detections. |
|
||||
> | 10 | Sha1 | fileHash | 3da065e07b990034e9db7842167f70b63aa5329 | Available for detections associated with a file or process. |
|
||||
> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Windows Defender AV detections. |
|
||||
> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Windows Defender AV detections. |
|
||||
> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Windows Defender AV detections. |
|
||||
> | 14 | IpAddress | sourceAddress | 218.90.204.141 | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. |
|
||||
> | 15 | Url | requestUrl | down.esales360.cn | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. |
|
||||
> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. |
|
||||
> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. |
|
||||
> | 18 | AlertId | externalId | 636210704265059241_673569822 | Value available for every Detection. |
|
||||
> | 19 | LinkToWDATP | flexString1 | `https://securitycenter.windows.com/alert/636210704265059241_673569822` | Value available for every Detection. |
|
||||
> | 20 | AlertTime | deviceReceiptTime | 2017-05-07T01:56:59.3191352Z | The time the event occurred. Value available for every Detection. |
|
||||
> | 21 | MachineDomain | sourceDnsDomain | contoso.com | Domain name not relevant for AAD joined machines. Value available for every Detection. |
|
||||
> | 22 | Actor | deviceCustomString4 | BORON | Available for alerts related to a known actor group. |
|
||||
> | 21+5 | ComputerDnsName | No mapping | liz-bean.contoso.com | The machine fully qualified domain name. Value available for every alert. |
|
||||
> | 21+5 | ComputerDnsName | No mapping | liz-bean.contoso.com | The machine fully qualified domain name. Value available for every Detection. |
|
||||
> | | LogOnUsers | sourceUserId | contoso\liz-bean; contoso\jay-hardee | The domain and user of the interactive logon user/s at the time of the event. Note: For machines on Windows 10 version 1607, the domain information will not be available. |
|
||||
> | | InternalIPv4List | No mapping | 192.168.1.7, 10.1.14.1 | List of IPV4 internal IPs for active network interfaces. |
|
||||
> | | InternalIPv6List | No mapping | fd30:0000:0000:0001:ff4e:003e:0009:000e, FE80:CD00:0000:0CDE:1257:0000:211E:729C | List of IPV6 internal IPs for active network interfaces. |
|
||||
> | Internal field | LastProcessedTimeUtc | No mapping | 2017-05-07T01:56:58.9936648Z | Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that alerts are retrieved. |
|
||||
> | Internal field | LastProcessedTimeUtc | No mapping | 2017-05-07T01:56:58.9936648Z | Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that detections are retrieved. |
|
||||
> | | Not part of the schema | deviceVendor | | Static value in the ArcSight mapping - 'Microsoft'. |
|
||||
> | | Not part of the schema | deviceProduct | | Static value in the ArcSight mapping - 'Microsoft Defender ATP'. |
|
||||
> | | Not part of the schema | deviceVersion | | Static value in the ArcSight mapping - '2.0', used to identify the mapping versions.
|
||||
@ -88,7 +91,7 @@ Field numbers match the numbers in the images below.
|
||||
|
||||
## Related topics
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md)
|
||||
- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure HP ArcSight to pull Microsoft Defender ATP alerts
|
||||
description: Configure HP ArcSight to receive and pull alerts from Microsoft Defender Security Center
|
||||
title: Configure HP ArcSight to pull Microsoft Defender ATP detections
|
||||
description: Configure HP ArcSight to receive and pull detections from Microsoft Defender Security Center
|
||||
keywords: configure hp arcsight, security information and events management tools, arcsight
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -15,10 +15,9 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 12/20/2018
|
||||
---
|
||||
|
||||
# Configure HP ArcSight to pull Microsoft Defender ATP alerts
|
||||
# Configure HP ArcSight to pull Microsoft Defender ATP detections
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -29,10 +28,14 @@ ms.date: 12/20/2018
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink)
|
||||
|
||||
You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Microsoft Defender ATP alerts.
|
||||
You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Microsoft Defender ATP detections.
|
||||
|
||||
>[!Note]
|
||||
>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections
|
||||
>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details.
|
||||
|
||||
## Before you begin
|
||||
Configuring the HP ArcSight Connector tool requires several configuration files for it to pull and parse alerts from your Azure Active Directory (AAD) application.
|
||||
Configuring the HP ArcSight Connector tool requires several configuration files for it to pull and parse detections from your Azure Active Directory (AAD) application.
|
||||
|
||||
This section guides you in getting the necessary information to set and use the required configuration files correctly.
|
||||
|
||||
@ -163,7 +166,7 @@ The following steps assume that you have completed all the required steps in [Be
|
||||
|
||||
You can now run queries in the HP ArcSight console.
|
||||
|
||||
Microsoft Defender ATP alerts will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name.
|
||||
Microsoft Defender ATP detections will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name.
|
||||
|
||||
|
||||
## Troubleshooting HP ArcSight connection
|
||||
@ -187,6 +190,6 @@ Microsoft Defender ATP alerts will appear as discrete events, with "Microsoft”
|
||||
|
||||
## Related topics
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md)
|
||||
- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Pull alerts to your SIEM tools from Microsoft Defender Advanced Threat Protection
|
||||
description: Learn how to use REST API and configure supported security information and events management tools to receive and pull alerts.
|
||||
title: Pull detections to your SIEM tools from Microsoft Defender Advanced Threat Protection
|
||||
description: Learn how to use REST API and configure supported security information and events management tools to receive and pull detections.
|
||||
keywords: configure siem, security information and events management tools, splunk, arcsight, custom indicators, rest api, alert definitions, indicators of compromise
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,7 +18,7 @@ ms.topic: article
|
||||
ms.date: 10/16/2017
|
||||
---
|
||||
|
||||
# Pull alerts to your SIEM tools
|
||||
# Pull detections to your SIEM tools
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -26,8 +26,13 @@ ms.date: 10/16/2017
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
||||
|
||||
## Pull alerts using security information and events management (SIEM) tools
|
||||
Microsoft Defender ATP supports (SIEM) tools to pull alerts. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
|
||||
## Pull detections using security information and events management (SIEM) tools
|
||||
|
||||
>[!Note]
|
||||
>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections
|
||||
>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details.
|
||||
|
||||
Microsoft Defender ATP supports (SIEM) tools to pull detections. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull detections from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
|
||||
|
||||
|
||||
Microsoft Defender ATP currently supports the following SIEM tools:
|
||||
@ -39,16 +44,16 @@ To use either of these supported SIEM tools you'll need to:
|
||||
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
- Configure the supported SIEM tool:
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)
|
||||
- [Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md)
|
||||
- [Configure HP ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md)
|
||||
|
||||
For more information on the list of fields exposed in the alerts API see, [Microsoft Defender ATP alert API fields](api-portal-mapping.md).
|
||||
For more information on the list of fields exposed in the Detection API see, [Microsoft Defender ATP Detection fields](api-portal-mapping.md).
|
||||
|
||||
|
||||
## Pull Microsoft Defender ATP alerts using REST API
|
||||
Microsoft Defender ATP supports the OAuth 2.0 protocol to pull alerts using REST API.
|
||||
## Pull Microsoft Defender ATP detections using REST API
|
||||
Microsoft Defender ATP supports the OAuth 2.0 protocol to pull detections using REST API.
|
||||
|
||||
For more information, see [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md).
|
||||
For more information, see [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md).
|
||||
|
||||
|
||||
## In this section
|
||||
@ -56,8 +61,8 @@ For more information, see [Pull Microsoft Defender ATP alerts using REST API](pu
|
||||
Topic | Description
|
||||
:---|:---
|
||||
[Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)| Learn about enabling the SIEM integration feature in the **Settings** page in the portal so that you can use and generate the required information to configure supported SIEM tools.
|
||||
[Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)| Learn about installing the REST API Modular Input app and other configuration settings to enable Splunk to pull Microsoft Defender ATP alerts.
|
||||
[Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)| Learn about installing the HP ArcSight REST FlexConnector package and the files you need to configure ArcSight to pull Microsoft Defender ATP alerts.
|
||||
[Microsoft Defender ATP alert API fields](api-portal-mapping.md) | Understand what data fields are exposed as part of the alerts API and how they map to Microsoft Defender Security Center.
|
||||
[Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) | Use the Client credentials OAuth 2.0 flow to pull alerts from Microsoft Defender ATP using REST API.
|
||||
[Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md)| Learn about installing the REST API Modular Input App and other configuration settings to enable Splunk to pull Microsoft Defender ATP detections.
|
||||
[Configure HP ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md)| Learn about installing the HP ArcSight REST FlexConnector package and the files you need to configure ArcSight to pull Microsoft Defender ATP detections.
|
||||
[Microsoft Defender ATP Detection fields](api-portal-mapping.md) | Understand what data fields are exposed as part of the alerts API and how they map to Microsoft Defender Security Center.
|
||||
[Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) | Use the Client credentials OAuth 2.0 flow to pull detections from Microsoft Defender ATP using REST API.
|
||||
[Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) | Address issues you might encounter when using the SIEM integration feature.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure Splunk to pull Microsoft Defender ATP alerts
|
||||
description: Configure Splunk to receive and pull alerts from Microsoft Defender Security Center.
|
||||
title: Configure Splunk to pull Microsoft Defender ATP detections
|
||||
description: Configure Splunk to receive and pull detections from Microsoft Defender Security Center.
|
||||
keywords: configure splunk, security information and events management tools, splunk
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -17,7 +17,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Configure Splunk to pull Microsoft Defender ATP alerts
|
||||
# Configure Splunk to pull Microsoft Defender ATP detections
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -28,7 +28,11 @@ ms.topic: article
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresplunk-abovefoldlink)
|
||||
|
||||
You'll need to configure Splunk so that it can pull Microsoft Defender ATP alerts.
|
||||
You'll need to configure Splunk so that it can pull Microsoft Defender ATP detections.
|
||||
|
||||
>[!Note]
|
||||
>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections
|
||||
>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details.
|
||||
|
||||
## Before you begin
|
||||
|
||||
@ -121,8 +125,8 @@ You'll need to configure Splunk so that it can pull Microsoft Defender ATP alert
|
||||
|
||||
After completing these configuration steps, you can go to the Splunk dashboard and run queries.
|
||||
|
||||
## View alerts using Splunk solution explorer
|
||||
Use the solution explorer to view alerts in Splunk.
|
||||
## View detections using Splunk solution explorer
|
||||
Use the solution explorer to view detections in Splunk.
|
||||
|
||||
1. In Splunk, go to **Settings** > **Searchers, reports, and alerts**.
|
||||
|
||||
@ -141,12 +145,12 @@ Use the solution explorer to view alerts in Splunk.
|
||||
|
||||
|
||||
>[!TIP]
|
||||
> To mininimize alert duplications, you can use the following query:
|
||||
> To mininimize Detection duplications, you can use the following query:
|
||||
>```source="rest://windows atp alerts" | spath | dedup _raw | table *```
|
||||
|
||||
## Related topics
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)
|
||||
- [Microsoft Defender ATP alert API fields](api-portal-mapping.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md)
|
||||
- [Microsoft Defender ATP Detection fields](api-portal-mapping.md)
|
||||
- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Enable SIEM integration in Microsoft Defender ATP
|
||||
description: Enable SIEM integration to receive alerts in your security information and event management (SIEM) solution.
|
||||
description: Enable SIEM integration to receive detections in your security information and event management (SIEM) solution.
|
||||
keywords: enable siem connector, siem, connector, security information and events
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -15,7 +15,6 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 12/10/2018
|
||||
---
|
||||
|
||||
# Enable SIEM integration in Microsoft Defender ATP
|
||||
@ -26,7 +25,11 @@ ms.date: 12/10/2018
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-enablesiem-abovefoldlink)
|
||||
|
||||
Enable security information and event management (SIEM) integration so you can pull alerts from Microsoft Defender Security Center using your SIEM solution or by connecting directly to the alerts REST API.
|
||||
Enable security information and event management (SIEM) integration so you can pull detections from Microsoft Defender Security Center using your SIEM solution or by connecting directly to the detections REST API.
|
||||
|
||||
>[!Note]
|
||||
>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections
|
||||
>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details.
|
||||
|
||||
## Prerequisites
|
||||
- The user who activates the setting must have permissions to create an app in Azure Active Directory (AAD). This is typically someone with a **Global administrator** role.
|
||||
@ -55,7 +58,7 @@ Enable security information and event management (SIEM) integration so you can p
|
||||
> - WDATP-connector.jsonparser.properties
|
||||
> - WDATP-connector.properties <br>
|
||||
|
||||
If you want to connect directly to the alerts REST API through programmatic access, choose **Generic API**.
|
||||
If you want to connect directly to the detections REST API through programmatic access, choose **Generic API**.
|
||||
|
||||
4. Copy the individual values or select **Save details to file** to download a file that contains all the values.
|
||||
|
||||
@ -64,14 +67,14 @@ Enable security information and event management (SIEM) integration so you can p
|
||||
> [!NOTE]
|
||||
> You'll need to generate a new Refresh token every 90 days.
|
||||
|
||||
You can now proceed with configuring your SIEM solution or connecting to the alerts REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive alerts from Microsoft Defender Security Center.
|
||||
You can now proceed with configuring your SIEM solution or connecting to the detections REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive detections from Microsoft Defender Security Center.
|
||||
|
||||
## Integrate Microsoft Defender ATP with IBM QRadar
|
||||
You can configure IBM QRadar to collect alerts from Microsoft Defender ATP. For more information, see [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/c_dsm_guide_MS_Win_Defender_ATP_overview.html?cp=SS42VS_7.3.1).
|
||||
You can configure IBM QRadar to collect detections from Microsoft Defender ATP. For more information, see [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/c_dsm_guide_MS_Win_Defender_ATP_overview.html?cp=SS42VS_7.3.1).
|
||||
|
||||
## Related topics
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)
|
||||
- [Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)
|
||||
- [Microsoft Defender ATP alert API fields](api-portal-mapping.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md)
|
||||
- [Configure HP ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md)
|
||||
- [Microsoft Defender ATP Detection fields](api-portal-mapping.md)
|
||||
- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||
|
||||
@ -1,122 +0,0 @@
|
||||
---
|
||||
title: Get IP related machines API
|
||||
description: Retrieves a collection of machines related to a given IP address.
|
||||
keywords: apis, graph api, supported apis, get, ip, related, machines
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get IP related machines API (Deprecated)
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Retrieves a collection of machines that communicated with or from a particular IP.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Machine.Read.All | 'Read all machine profiles'
|
||||
Application | Machine.ReadWrite.All | 'Read and write all machine information'
|
||||
Delegated (work or school account) | Machine.Read | 'Read machine information'
|
||||
Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information'
|
||||
|
||||
>[!Note]
|
||||
> When obtaining a token using user credentials:
|
||||
>- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information)
|
||||
>- Response will include only machines, that the user have access to, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information)
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/ips/{ip}/machines
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and IP exists - 200 OK with list of [machine](machine.md) entities in the body. If IP do not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
[!include[Improve request performance](improve-request-performance.md)]
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/ips/10.209.67.177/machines
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
|
||||
"value": [
|
||||
{
|
||||
"id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
|
||||
"computerDnsName": "mymachine1.contoso.com",
|
||||
"firstSeen": "2018-08-02T14:55:03.7791856Z",
|
||||
"lastSeen": "2018-08-02T14:55:03.7791856Z",
|
||||
"osPlatform": "Windows10",
|
||||
"osVersion": "10.0.0.0",
|
||||
"lastIpAddress": "172.17.230.209",
|
||||
"lastExternalIpAddress": "167.220.196.71",
|
||||
"agentVersion": "10.5830.18209.1001",
|
||||
"osBuild": 18209,
|
||||
"healthStatus": "Active",
|
||||
"rbacGroupId": 140,
|
||||
"riskScore": "Low",
|
||||
"rbacGroupName": "The-A-Team",
|
||||
"aadDeviceId": "80fe8ff8-2624-418e-9591-41f0491218f9",
|
||||
"machineTags": [ "test tag 1", "test tag 2" ]
|
||||
},
|
||||
{
|
||||
"id": "7292e4b8cb74ff1cc3d8a495eb29dc8858b732f7",
|
||||
"computerDnsName": "mymachine2.contoso.com",
|
||||
"firstSeen": "2018-07-09T13:22:45.1250071Z",
|
||||
"lastSeen": "2018-07-09T13:22:45.1250071Z",
|
||||
"osPlatform": "Windows10",
|
||||
"osVersion": "10.0.0.0",
|
||||
"lastIpAddress": "192.168.12.225",
|
||||
"lastExternalIpAddress": "79.183.65.82",
|
||||
"agentVersion": "10.5820.17724.1000",
|
||||
"osBuild": 17724,
|
||||
"healthStatus": "Inactive",
|
||||
"rbacGroupId": 140,
|
||||
"rbacGroupName": "The-A-Team",
|
||||
"riskScore": "Low",
|
||||
"aadDeviceId": null,
|
||||
"machineTags": [ "test tag 1" ]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 90 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 51 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 21 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 121 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 98 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 104 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 7.5 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 23 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 7.6 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 7.8 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 82 KiB |
@ -1,82 +0,0 @@
|
||||
---
|
||||
title: Is domain seen in org API
|
||||
description: Use this API to create calls related to checking whether a domain was seen in the organization.
|
||||
keywords: apis, graph api, supported apis, domain, domain seen
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Was domain seen in org (Deprecated)
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Answers whether a domain was seen in the organization.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Url.Read.All | 'Read URLs'
|
||||
Delegated (work or school account) | URL.Read.All | 'Read URLs'
|
||||
|
||||
>[!Note]
|
||||
> When obtaining a token using user credentials:
|
||||
>- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information)
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/domains/{domain}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and domain exists - 200 OK. If domain does not exist - 404 Not Found.
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
[!include[Improve request performance](improve-request-performance.md)]
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/domains/example.com
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Domains/$entity",
|
||||
"host": "example.com"
|
||||
}
|
||||
```
|
||||
@ -1,82 +0,0 @@
|
||||
---
|
||||
title: Is IP seen in org API
|
||||
description: Answers whether an IP was seen in the organization.
|
||||
keywords: apis, graph api, supported apis, is, ip, seen, org, organization
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Was IP seen in org (Deprecated)
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Answers whether an IP was seen in the organization.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Ip.Read.All | 'Read IP address profiles'
|
||||
Delegated (work or school account) | Ip.Read.All | 'Read IP address profiles'
|
||||
|
||||
>[!Note]
|
||||
> When obtaining a token using user credentials:
|
||||
>- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information)
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/ips/{ip}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and IP exists - 200 OK. If IP do not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/ips/10.209.67.177
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
[!include[Improve request performance](improve-request-performance.md)]
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Ips/$entity",
|
||||
"id": "10.209.67.177"
|
||||
}
|
||||
```
|
||||
@ -52,7 +52,6 @@ An important aspect of machine management is the ability to analyze the environm
|
||||
Topic | Description
|
||||
:---|:---
|
||||
Understand threat intelligence concepts | Learn about alert definitions, indicators of compromise, and other threat intelligence concepts.
|
||||
Supported Microsoft Defender ATP APIs | Learn more about the individual supported entities where you can run API calls to and details such as HTTP request values, request headers and expected responses.
|
||||
Managed security service provider | Get a quick overview on managed security service provider support.
|
||||
|
||||
|
||||
|
||||
@ -392,7 +392,6 @@
|
||||
####### [Get domain related alerts](get-domain-related-alerts.md)
|
||||
####### [Get domain related machines](get-domain-related-machines.md)
|
||||
####### [Get domain statistics](get-domain-statistics.md)
|
||||
####### [Is domain seen in organization (Deprecated)](is-domain-seen-in-org.md)
|
||||
|
||||
###### [File]()
|
||||
####### [Methods and properties](files.md)
|
||||
@ -403,9 +402,7 @@
|
||||
|
||||
###### [IP]()
|
||||
####### [Get IP related alerts](get-ip-related-alerts.md)
|
||||
####### [Get IP related machines (Deprecated)](get-ip-related-machines.md)
|
||||
####### [Get IP statistics](get-ip-statistics.md)
|
||||
####### [Is IP seen in organization (Deprecated)](is-ip-seen-org.md)
|
||||
|
||||
###### [User]()
|
||||
####### [Methods](user.md)
|
||||
@ -428,13 +425,13 @@
|
||||
##### [Experiment with custom threat intelligence alerts](experiment-custom-ti.md)
|
||||
##### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti.md)
|
||||
|
||||
#### [Pull alerts to your SIEM tools]()
|
||||
##### [Learn about different ways to pull alerts](configure-siem.md)
|
||||
#### [Pull Detections to your SIEM tools]()
|
||||
##### [Learn about different ways to pull Detections](configure-siem.md)
|
||||
##### [Enable SIEM integration](enable-siem-integration.md)
|
||||
##### [Configure Splunk to pull alerts](configure-splunk.md)
|
||||
##### [Configure HP ArcSight to pull alerts](configure-arcsight.md)
|
||||
##### [Microsoft Defender ATP SIEM alert API fields](api-portal-mapping.md)
|
||||
##### [Pull alerts using SIEM REST API](pull-alerts-using-rest-api.md)
|
||||
##### [Configure Splunk to pull Detections](configure-splunk.md)
|
||||
##### [Configure HP ArcSight to pull Detections](configure-arcsight.md)
|
||||
##### [Microsoft Defender ATP Detection fields](api-portal-mapping.md)
|
||||
##### [Pull Detections using SIEM REST API](pull-alerts-using-rest-api.md)
|
||||
##### [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||
|
||||
#### [Reporting]()
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Pull Microsoft Defender ATP alerts using REST API
|
||||
description: Pull alerts from Microsoft Defender ATP REST API.
|
||||
keywords: alerts, pull alerts, rest api, request, response
|
||||
title: Pull Microsoft Defender ATP detections using REST API
|
||||
description: Pull detections from Microsoft Defender ATP REST API.
|
||||
keywords: detections, pull detections, rest api, request, response
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -17,7 +17,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Pull Microsoft Defender ATP alerts using SIEM REST API
|
||||
# Pull Microsoft Defender ATP detections using SIEM REST API
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
@ -26,7 +26,11 @@ ms.topic: article
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-pullalerts-abovefoldlink)
|
||||
|
||||
Microsoft Defender ATP supports the OAuth 2.0 protocol to pull alerts from the portal.
|
||||
>[!Note]
|
||||
>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections
|
||||
>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details.
|
||||
|
||||
Microsoft Defender ATP supports the OAuth 2.0 protocol to pull detections from the API.
|
||||
|
||||
In general, the OAuth 2.0 protocol supports four types of flows:
|
||||
- Authorization grant flow
|
||||
@ -36,19 +40,19 @@ In general, the OAuth 2.0 protocol supports four types of flows:
|
||||
|
||||
For more information about the OAuth specifications, see the [OAuth Website](http://www.oauth.net).
|
||||
|
||||
Microsoft Defender ATP supports the _Authorization grant flow_ and _Client credential flow_ to obtain access to generate alerts from the portal, with Azure Active Directory (AAD) as the authorization server.
|
||||
Microsoft Defender ATP supports the _Authorization grant flow_ and _Client credential flow_ to obtain access to pull detections, with Azure Active Directory (AAD) as the authorization server.
|
||||
|
||||
The _Authorization grant flow_ uses user credentials to get an authorization code, which is then used to obtain an access token.
|
||||
|
||||
The _Client credential flow_ uses client credentials to authenticate against the Microsoft Defender ATP endpoint URL. This flow is suitable for scenarios when an OAuth client creates requests to an API that doesn't require user credentials.
|
||||
|
||||
Use the following method in the Microsoft Defender ATP API to pull alerts in JSON format.
|
||||
Use the following method in the Microsoft Defender ATP API to pull detections in JSON format.
|
||||
|
||||
>[!NOTE]
|
||||
>Microsoft Defender Security Center merges similar alert detections into a single alert. This API pulls alert detections in its raw form based on the query parameters you set, enabling you to apply your own grouping and filtering.
|
||||
|
||||
## Before you begin
|
||||
- Before calling the Microsoft Defender ATP endpoint to pull alerts, you'll need to enable the SIEM integration application in Azure Active Directory (AAD). For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md).
|
||||
- Before calling the Microsoft Defender ATP endpoint to pull detections, you'll need to enable the SIEM integration application in Azure Active Directory (AAD). For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md).
|
||||
|
||||
- Take note of the following values in your Azure application registration. You need these values to configure the OAuth flow in your service or daemon app:
|
||||
- Application ID (unique to your application)
|
||||
@ -59,7 +63,7 @@ Use the following method in the Microsoft Defender ATP API to pull alerts in JSO
|
||||
## Get an access token
|
||||
Before creating calls to the endpoint, you'll need to get an access token.
|
||||
|
||||
You'll use the access token to access the protected resource, which are alerts in Microsoft Defender ATP.
|
||||
You'll use the access token to access the protected resource, which are detections in Microsoft Defender ATP.
|
||||
|
||||
To get an access token, you'll need to do a POST request to the token issuing endpoint. Here is a sample request:
|
||||
|
||||
@ -105,23 +109,23 @@ Use optional query parameters to specify and control the amount of data returned
|
||||
|
||||
Name | Value| Description
|
||||
:---|:---|:---
|
||||
DateTime?sinceTimeUtc | string | Defines the lower time bound alerts are retrieved from, based on field: <br> `LastProcessedTimeUtc` <br> The time range will be: from sinceTimeUtc time to current time. <br><br> **NOTE**: When not specified, all alerts generated in the last two hours are retrieved.
|
||||
DateTime?untilTimeUtc | string | Defines the upper time bound alerts are retrieved. <br> The time range will be: from `sinceTimeUtc` time to `untilTimeUtc` time. <br><br> **NOTE**: When not specified, the default value will be the current time.
|
||||
string ago | string | Pulls alerts in the following time range: from `(current_time - ago)` time to `current_time` time. <br><br> Value should be set according to **ISO 8601** duration format <br> E.g. `ago=PT10M` will pull alerts received in the last 10 minutes.
|
||||
int?limit | int | Defines the number of alerts to be retrieved. Most recent alerts will be retrieved based on the number defined.<br><br> **NOTE**: When not specified, all alerts available in the time range will be retrieved.
|
||||
machinegroups | String | Specifies machine groups to pull alerts from. <br><br> **NOTE**: When not specified, alerts from all machine groups will be retrieved. <br><br> Example: <br><br> ```https://wdatp-alertexporter-eu.securitycenter.windows.com/api/Alerts/?machinegroups=UKMachines&machinegroups=FranceMachines```
|
||||
DateTime?sinceTimeUtc | string | Defines the lower time bound detections are retrieved from, based on field: <br> `LastProcessedTimeUtc` <br> The time range will be: from sinceTimeUtc time to current time. <br><br> **NOTE**: When not specified, all detections generated in the last two hours are retrieved.
|
||||
DateTime?untilTimeUtc | string | Defines the upper time bound detections are retrieved. <br> The time range will be: from `sinceTimeUtc` time to `untilTimeUtc` time. <br><br> **NOTE**: When not specified, the default value will be the current time.
|
||||
string ago | string | Pulls detections in the following time range: from `(current_time - ago)` time to `current_time` time. <br><br> Value should be set according to **ISO 8601** duration format <br> E.g. `ago=PT10M` will pull detections received in the last 10 minutes.
|
||||
int?limit | int | Defines the number of detections to be retrieved. Most recent detections will be retrieved based on the number defined.<br><br> **NOTE**: When not specified, all detections available in the time range will be retrieved.
|
||||
machinegroups | String | Specifies machine groups to pull detections from. <br><br> **NOTE**: When not specified, detections from all machine groups will be retrieved. <br><br> Example: <br><br> ```https://wdatp-alertexporter-eu.securitycenter.windows.com/api/Alerts/?machinegroups=UKMachines&machinegroups=FranceMachines```
|
||||
DeviceCreatedMachineTags | string | Single machine tag from the registry.
|
||||
CloudCreatedMachineTags | string | Machine tags that were created in Microsoft Defender Security Center.
|
||||
|
||||
### Request example
|
||||
The following example demonstrates how to retrieve all the alerts in your organization.
|
||||
The following example demonstrates how to retrieve all the detections in your organization.
|
||||
|
||||
```syntax
|
||||
GET https://wdatp-alertexporter-eu.windows.com/api/alerts
|
||||
Authorization: Bearer <your access token>
|
||||
```
|
||||
|
||||
The following example demonstrates a request to get the last 20 alerts since 2016-09-12 00:00:00.
|
||||
The following example demonstrates a request to get the last 20 detections since 2016-09-12 00:00:00.
|
||||
|
||||
```syntax
|
||||
GET https://wdatp-alertexporter-eu.windows.com/api/alerts?limit=20&sinceTimeUtc=2016-09-12T00:00:00.000
|
||||
@ -178,14 +182,14 @@ AuthenticationContext context = new AuthenticationContext(string.Format("https:/
|
||||
ClientCredential clientCredentials = new ClientCredential(clientId, clientSecret);
|
||||
AuthenticationResult authenticationResult = context.AcquireToken(resource, clientCredentials);
|
||||
```
|
||||
### Use token to connect to the alerts endpoint
|
||||
### Use token to connect to the detections endpoint
|
||||
|
||||
```
|
||||
HttpClient httpClient = new HttpClient();
|
||||
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(authenticationResult.AccessTokenType, authenticationResult.AccessToken);
|
||||
HttpResponseMessage response = httpClient.GetAsync("https://wdatp-alertexporter-eu.windows.com/api/alert").GetAwaiter().GetResult();
|
||||
string alertsJson = response.Content.ReadAsStringAsync().Result;
|
||||
Console.WriteLine("Got alert list: {0}", alertsJson);
|
||||
string detectionsJson = response.Content.ReadAsStringAsync().Result;
|
||||
Console.WriteLine("Got detections list: {0}", detectionsJson);
|
||||
|
||||
```
|
||||
|
||||
@ -203,7 +207,7 @@ HTTP error code | Description
|
||||
|
||||
## Related topics
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)
|
||||
- [Microsoft Defender ATP alert API fields](api-portal-mapping.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md)
|
||||
- [Microsoft Defender ATP Detection fields](api-portal-mapping.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||
|
||||
@ -188,3 +188,4 @@ All other related details are also shown, for example, submission date/time, sub
|
||||
|
||||
## Related topic
|
||||
- [Take response actions on a file](respond-file-alerts.md)
|
||||
- [Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy)
|
||||
|
||||
@ -25,7 +25,7 @@ ms.topic: troubleshooting
|
||||
|
||||
|
||||
|
||||
You might need to troubleshoot issues while pulling alerts in your SIEM tools.
|
||||
You might need to troubleshoot issues while pulling detections in your SIEM tools.
|
||||
|
||||
This page provides detailed steps to troubleshoot issues you might encounter.
|
||||
|
||||
@ -80,7 +80,7 @@ If you encounter an error when trying to enable the SIEM connector application,
|
||||
|
||||
## Related topics
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)
|
||||
- [Microsoft Defender ATP alert API fields](api-portal-mapping.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md)
|
||||
- [Microsoft Defender ATP Detection fields](api-portal-mapping.md)
|
||||
- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md)
|
||||
|
||||
@ -54,6 +54,31 @@ From that page, you can do any of the following depending on what you need to do
|
||||
|
||||
- Choose from exception options - Submit an exception, provide justification, and set exception duration if you can't remediate the issue just yet due to specific business reasons, compensation controls, or if it is a false positive.
|
||||
|
||||
## Report inaccuracy
|
||||
|
||||
You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated security recommendation information in the machine page.
|
||||
|
||||
1. Select the **Security recommendation** tab.
|
||||
|
||||
2. Click **:** beside the security recommendation that you want to report about, then select **Report inaccuracy**.
|
||||
|
||||
<br>A flyout pane opens.</br>
|
||||
|
||||
|
||||
3. From the flyout pane, select the inaccuracy category from the drop-down menu.
|
||||
<br></br>
|
||||
|
||||
4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported.
|
||||
|
||||
5. Include your machine name for investigation context.
|
||||
|
||||
>[!NOTE]
|
||||
> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context.
|
||||
|
||||
6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context.
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
@ -33,6 +33,30 @@ In the field of discovery, we are leveraging the same set of signals in Microsof
|
||||
|
||||
Since it is real-time, in a matter of minutes, you will see vulnerability information as they get discovered. The engine automatically grabs information from multiple security feeds. In fact, you'll will see if a particular application is connected to a live campaign. It also provides a link to a Threat Analytics report soon as it's available.
|
||||
|
||||
## Report inaccuracy
|
||||
|
||||
You can report a false positive when you see any vague, inaccurate version, incomplete, or already remediated software inventory information in the machine page.
|
||||
|
||||
1. Select the **Software inventory** tab.
|
||||
|
||||
2. Click **:** beside the software that you want to report about, and then select **Report inaccuracy**.
|
||||
|
||||
<br>A flyout pane opens.</br>
|
||||
|
||||
|
||||
3. From the flyout pane, select the inaccuracy category from the **Software inventory inaccuracy reason** drop-down menu.
|
||||
<br></br>
|
||||
|
||||
4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported.
|
||||
|
||||
5. Include your machine name for investigation context.
|
||||
|
||||
>[!NOTE]
|
||||
> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context.
|
||||
|
||||
6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context.
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md)
|
||||
|
||||
@ -26,7 +26,7 @@ Threat & Vulnerability Management leverages the same signals in Microsoft Defend
|
||||
The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization, their severity, Common Vulnerability Scoring System (CVSS) rating, its prevalence in your organization, corresponding breach, and threat insights.
|
||||
|
||||
## Navigate through your organization's weaknesses page
|
||||
You can see the list of vulnerabilities in three ways:
|
||||
You can see the list of vulnerabilities in four ways:
|
||||
|
||||
*Vulnerabilities in global search*
|
||||
1. Click the global search drop-down menu.
|
||||
@ -48,6 +48,18 @@ You can see the list of vulnerabilities in three ways:
|
||||
3. Select the **Discovered vulnerabilities** tab.
|
||||
4. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates.
|
||||
|
||||
*Discovered vulnerabilities in the machine page*
|
||||
1. Go to the left-hand navigation menu bar, then select the machine icon. The **Machines list** page opens.
|
||||
<br></br>
|
||||
2. In the **Machines list** page, select the machine that you want to investigate.
|
||||
<br></br>
|
||||
<br>A flyout pane opens with machine details and response action options.</br>
|
||||
|
||||
3. In the flyout pane, select **Open machine page**. A page opens with details and response options for the machine you want to investigate.
|
||||
<br></br>
|
||||
4. Select **Discovered vulnerabilities**.
|
||||
5. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates.
|
||||
|
||||
## How it works
|
||||
When new vulnerabilities are released, you would want know how many of your assets are exposed. You can see the list of vulnerabilities and the details in the **Weaknesses** page.
|
||||
|
||||
@ -66,6 +78,29 @@ The threat insights icons are highlighted if there are associated exploits in th
|
||||
>[!NOTE]
|
||||
> Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight  icon and possible active alert  icon.
|
||||
|
||||
## Report inaccuracy
|
||||
|
||||
You can report a false positive when you see any vague, inaccurate, missing, or already remediated vulnerability information in the machine page.
|
||||
|
||||
1. Select the **Discovered vulnerabilities** tab.
|
||||
|
||||
2. Click **:** beside the vulnerability that you want to report about, and then select **Report inaccuracy**.
|
||||
|
||||
<br>A flyout pane opens.</br>
|
||||
|
||||
|
||||
3. From the flyout pane, select the inaccuracy category from the **Discovered vulnerability inaccuracy reason** drop-down menu.
|
||||
<br></br>
|
||||
|
||||
4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported.
|
||||
|
||||
5. Include your machine name for investigation context.
|
||||
|
||||
>[!NOTE]
|
||||
> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context.
|
||||
|
||||
6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context.
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
@ -35,6 +35,9 @@ This topic describes the structure of this profile (including a recommended prof
|
||||
|
||||
The configuration profile is a .plist file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences.
|
||||
|
||||
>[!CAUTION]
|
||||
>The layout of the configuration profile depends on the management console that you are using. The following sections contain examples of configuration profiles for JAMF and Intune.
|
||||
|
||||
The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections.
|
||||
|
||||
### Antivirus engine preferences
|
||||
@ -222,6 +225,8 @@ The following configuration profile will:
|
||||
- Enable cloud delivered protection
|
||||
- Enable automatic sample submission
|
||||
|
||||
### JAMF profile
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
@ -258,10 +263,91 @@ The following configuration profile will:
|
||||
</plist>
|
||||
```
|
||||
|
||||
### Intune profile
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1">
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Microsoft Defender ATP settings</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Microsoft Defender ATP configuration settings</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<true/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Microsoft Defender ATP configuration settings</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>antivirusEngine</key>
|
||||
<dict>
|
||||
<key>enableRealTimeProtection</key>
|
||||
<true/>
|
||||
<key>threatTypeSettings</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>key</key>
|
||||
<string>potentially_unwanted_application</string>
|
||||
<key>value</key>
|
||||
<string>block</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>key</key>
|
||||
<string>archive_bomb</string>
|
||||
<key>value</key>
|
||||
<string>audit</string>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
<key>cloudService</key>
|
||||
<dict>
|
||||
<key>enabled</key>
|
||||
<true/>
|
||||
<key>automaticSampleSubmission</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
## Full configuration profile example
|
||||
|
||||
The following configuration profile contains entries for all settings described in this document and can be used for more advanced scenarios where you want more control over the product.
|
||||
|
||||
### JAMF profile
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
@ -329,6 +415,116 @@ The following configuration profile contains entries for all settings described
|
||||
</plist>
|
||||
```
|
||||
|
||||
### Intune profile
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1">
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Microsoft Defender ATP settings</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Microsoft Defender ATP configuration settings</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<true/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadUUID</key>
|
||||
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.microsoft.wdav</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>Microsoft</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Microsoft Defender ATP configuration settings</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string/>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
<key>PayloadEnabled</key>
|
||||
<true/>
|
||||
<key>antivirusEngine</key>
|
||||
<dict>
|
||||
<key>enableRealTimeProtection</key>
|
||||
<true/>
|
||||
<key>exclusions</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>$type</key>
|
||||
<string>excludedPath</string>
|
||||
<key>isDirectory</key>
|
||||
<false/>
|
||||
<key>path</key>
|
||||
<string>/var/log/system.log</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>$type</key>
|
||||
<string>excludedPath</string>
|
||||
<key>isDirectory</key>
|
||||
<true/>
|
||||
<key>path</key>
|
||||
<string>/home</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>$type</key>
|
||||
<string>excludedFileExtension</string>
|
||||
<key>extension</key>
|
||||
<string>pdf</string>
|
||||
</dict>
|
||||
</array>
|
||||
<key>allowedThreats</key>
|
||||
<array>
|
||||
<string>eicar</string>
|
||||
</array>
|
||||
<key>threatTypeSettings</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>key</key>
|
||||
<string>potentially_unwanted_application</string>
|
||||
<key>value</key>
|
||||
<string>block</string>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>key</key>
|
||||
<string>archive_bomb</string>
|
||||
<key>value</key>
|
||||
<string>audit</string>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
<key>cloudService</key>
|
||||
<dict>
|
||||
<key>enabled</key>
|
||||
<true/>
|
||||
<key>diagnosticLevel</key>
|
||||
<string>optional</string>
|
||||
<key>automaticSampleSubmission</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
## Configuration profile deployment
|
||||
|
||||
Once you've built the configuration profile for your enterprise, you can deploy it through the management console that your enterprise is using. The following sections provide instructions on how to deploy this profile using JAMF and Intune.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user