mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-28 21:27:23 +00:00
Merge branch 'master' of https://github.com/MicrosoftDocs/windows-docs-pr into DOtrouble
This commit is contained in:
jaimeo
commit
fbc47cb223
File diff suppressed because it is too large
Load Diff
@ -92,7 +92,7 @@ sections:
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/developer-settings-gp
|
||||
|
||||
html: <p>Learn how configure Microsoft Edge for development and testing.</p>
|
||||
html: <p>Learn how to configure Microsoft Edge for development and testing.</p>
|
||||
|
||||
image:
|
||||
|
||||
|
||||
@ -6,4 +6,4 @@ ms.prod: edge
|
||||
ms:topic: include
|
||||
---
|
||||
|
||||
Microsoft Edge uses Windows Defender SmartScreen (turned on) to protect users from potential phishing scams and malicious software by default. Also, by default, users cannot disable (turn off) Windows Defender SmartScreen. Enabling this policy turns off Windows Defender SmartScreen and prevent users from turning it on. Don’t configure this policy to let users choose to turn Windows defender SmartScreen on or off.
|
||||
Microsoft Edge uses Windows Defender SmartScreen (turned on) to protect users from potential phishing scams and malicious software by default. Also, by default, users cannot disable (turn off) Windows Defender SmartScreen. Enabling this policy turns on Windows Defender SmartScreen and prevent users from turning it off. Don’t configure this policy to let users choose to turn Windows defender SmartScreen on or off.
|
||||
|
||||
@ -43,7 +43,10 @@ You must download the deployment folder (**EMIEWebPortal/**), which includes all
|
||||
|
||||
Installs the npm package manager and bulk adds all the third-party libraries back into your codebase.
|
||||
|
||||
6. Go back up a directory, open the solution file **EMIEWebPortal.sln** in Visual Studio, and then build the entire solution.
|
||||
6. Go back up a directory, open the solution file **EMIEWebPortal.sln** in Visual Studio, open **Web.config** from **EMIEWebPortal/** folder, and replace MSIT-LOB-COMPAT with your server name hosting your database, replace LOBMerged with your database name, and build the entire solution.
|
||||
|
||||
>[!Note]
|
||||
>Step 3 of this topic provides the steps to create your database.
|
||||
|
||||
7. Copy the contents of the **EMIEWebPortal/** folder to a dedicated folder on your file system. For example, _D:\EMIEWebApp_. In a later step, you'll designate this folder as your website in the IIS Manager.
|
||||
|
||||
@ -105,17 +108,6 @@ Create a new Application Pool and the website, by using the IIS Manager.
|
||||
>[!Note]
|
||||
>You must also make sure that **Anonymous Authentication** is marked as **Enabled**.
|
||||
|
||||
10. Return to the **<<i>website_name</i>> Home** pane, and double-click the **Connection Strings** icon.
|
||||
|
||||
11. Open the **LOBMergedEntities Connection String** to edit:
|
||||
|
||||
- **Data source.** Type the name of your local computer.
|
||||
|
||||
- **Initial catalog.** The name of your database.
|
||||
|
||||
>[!Note]
|
||||
>Step 3 of this topic provides the steps to create your database.
|
||||
|
||||
## Step 3 - Create and prep your database
|
||||
Create a SQL Server database and run our custom query to create the Enterprise Mode Site List tables.
|
||||
|
||||
|
||||
@ -28,8 +28,8 @@ Organizations or schools of any size can benefit from using Microsoft Store for
|
||||
- **Scales to fit the size of your business** - For smaller businesses, with Azure AD accounts or Office 365 accounts and Windows 10 devices, you can quickly have an end-to-end process for acquiring and distributing content using the Store for Business. For larger businesses, all the capabilities of the Store for Business are available to you, or you can integrate Microsoft Store for Business with management tools, for greater control over access to apps and app updates. You can use existing work or school accounts.
|
||||
- **Bulk app acquisition** - Acquire apps in volume from Microsoft Store for Business.
|
||||
- **Centralized management** – Microsoft Store provides centralized management for inventory, billing, permissions, and order history. You can use Microsoft Store to view, manage and distribute items purchased from:
|
||||
- **Microsoft Store for Business** – Apps and subscriptions
|
||||
- **Microsoft Store for Education** – Apps and subscriptions
|
||||
- **Microsoft Store for Business** – Apps acquired from Microsoft Store for Business
|
||||
- **Microsoft Store for Education** – Apps acquired from Microsoft Store for Education
|
||||
- **Office 365** – Subscriptions
|
||||
- **Volume licensing** - Apps purchased with volume licensing
|
||||
- **Private store** - Create a private store for your business that’s easily available from any Windows 10 device. Your private store is available from Microsoft Store on Windows 10, or with a browser on the Web. People in your organization can download apps from your organization's private store on Windows 10 devices.
|
||||
|
||||
@ -93,20 +93,11 @@ The following table lists the supported shell extensions:
|
||||
|
||||
Copy on write (CoW) file extensions allow App-V to dynamically write to specific locations contained in the virtual package while it is being used.
|
||||
|
||||
The following table displays the file types that can exist in a virtual package under the VFS directory, but cannot be updated on the computer running the App-V client. All other files and directories can be modified.
|
||||
The following table displays the file types that can exist in a virtual package under the VFS directory, since App-V 5.1, but which cannot be updated on the computer running the App-V client. All other files and directories can be modified.
|
||||
|
||||
| File Type||||||
|
||||
|---|---|---|---|---|---|
|
||||
| .acm | .asa | .asp | .aspx | .ax | .bat |
|
||||
| .cer | .chm | .clb | .cmd | .cnt | .cnv |
|
||||
| .com | .cpl | .cpx | .crt | .dll | .drv |
|
||||
| .esc | .exe | .fon | .grp | .hlp | .hta |
|
||||
| .ime | .inf | .ins | .isp | .its | .js |
|
||||
| .jse | .lnk | .msc | .msi | .msp | .mst |
|
||||
| .mui | .nls | .ocx | .pal | .pcd | .pif |
|
||||
| .reg | .scf | .scr | .sct | .shb | .shs |
|
||||
| .sys | .tlb | .tsp | .url | .vb | .vbe |
|
||||
| .vbs | .vsmacros | .ws | .wsf | .wsh | |
|
||||
| .com | .exe | .dll | .ocx | |
|
||||
|
||||
## Modifying an existing virtual application package
|
||||
|
||||
|
||||
@ -108,6 +108,15 @@ Requirements:
|
||||
- Ensure that PCs belong to same computer group.
|
||||
|
||||
1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**.
|
||||
>[!Note]
|
||||
>If you do not see the policy, it may be caused because you don’t have the ADMX installed for Windows 10, version 1803. To fix the issue, follow these steps:
|
||||
> 1. Download [Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)
|
||||
](https://www.microsoft.com/en-us/download/details.aspx?id=56880).
|
||||
> 2. Install the package on the Primary Domain Controller.
|
||||
> 3. Navigate to the folder **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2**.
|
||||
> 4. Copy policy definitions folder to **C:\Windows\SYSVOL\domain\Policies**.
|
||||
> 5. Restart the Primary Domain Controller for the policy to be available.
|
||||
|
||||
2. Create a Security Group for the PCs.
|
||||
3. Link the GPO.
|
||||
4. Filter using Security Groups.
|
||||
|
||||
@ -1262,6 +1262,9 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
<dd>
|
||||
<a href="./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing" id="experience-preventusersfromturningonbrowsersyncing">Experience/PreventUsersFromTurningOnBrowserSyncing</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-experience.md#experience-showlockonusertile" id="experience-showlockonusertile">Experience/ShowLockOnUserTile</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ExploitGuard policies
|
||||
@ -4432,6 +4435,7 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
- [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications)
|
||||
- [Experience/DoNotSyncBrowserSettings](./policy-csp-experience.md#experience-donotsyncbrowsersetting)
|
||||
- [Experience/PreventUsersFromTurningOnBrowserSyncing](./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing)
|
||||
- [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile)
|
||||
- [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings)
|
||||
- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer)
|
||||
- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption)
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: MariciaAlforque
|
||||
ms.date: 05/01/2019
|
||||
ms.date: 05/14/2019
|
||||
---
|
||||
|
||||
# Policy CSP - Experience
|
||||
@ -96,6 +96,9 @@ ms.date: 05/01/2019
|
||||
<dd>
|
||||
<a href="#experience-preventusersfromturningonbrowsersyncing">Experience/PreventUsersFromTurningOnBrowserSyncing</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#experience-showlockonusertile">Experience/ShowLockOnUserTile</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
@ -1569,6 +1572,75 @@ Validation procedure:
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="experience-showlockonusertile"></a>**Experience/ShowLockOnUserTile**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Shows or hides lock from the user tile menu.
|
||||
|
||||
If you enable this policy setting, the lock option is shown in the User Tile menu.
|
||||
|
||||
If you disable this policy setting, the lock option is never shown in the User Tile menu.
|
||||
|
||||
If you do not configure this policy setting, the lock option is shown in the User Tile menu. Users can choose if they want to show the lock in the user tile menu from the Power Options control panel.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP English name: *Show lock in the user tile menu*
|
||||
- GP name: *ShowLockOption*
|
||||
- GP path: *File Explorer*
|
||||
- GP ADMX file name: *WindowsExplorer.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
Supported values:
|
||||
- false - The lock option is not displayed in the User Tile menu.
|
||||
- true (default) - The lock option is displayed in the User Tile menu.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
<!--StartHoloLens-->
|
||||
@ -1592,4 +1664,4 @@ Footnotes:
|
||||
- 3 - Added in Windows 10, version 1709.
|
||||
- 4 - Added in Windows 10, version 1803.
|
||||
- 5 - Added in Windows 10, version 1809.
|
||||
- 6 - Added in the next major release of Windows 10.
|
||||
- 6 - Added in Windows 10, version 1903.
|
||||
@ -24,12 +24,6 @@ ms.date: 06/26/2018
|
||||
<dd>
|
||||
<a href="#localpoliciessecurityoptions-accounts-blockmicrosoftaccounts">LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#localpoliciessecurityoptions-accounts-enableadministratoraccountstatus">LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#localpoliciessecurityoptions-accounts-enableguestaccountstatus">LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly">LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly</a>
|
||||
</dd>
|
||||
@ -255,131 +249,6 @@ The following list shows the supported values:
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="localpoliciessecurityoptions-accounts-enableadministratoraccountstatus"></a>**LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This security setting determines whether the local Administrator account is enabled or disabled.
|
||||
|
||||
If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password.
|
||||
Disabling the Administrator account can become a maintenance issue under certain circumstances.
|
||||
|
||||
Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled.
|
||||
|
||||
Default: Disabled.
|
||||
|
||||
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<!--/Description-->
|
||||
<!--DbMapped-->
|
||||
GP Info:
|
||||
- GP English name: *Accounts: Administrator account status*
|
||||
- GP path: *Windows Settings/Security Settings/Local Policies/Security Options*
|
||||
|
||||
<!--/DbMapped-->
|
||||
<!--SupportedValues-->
|
||||
Valid values:
|
||||
- 0 - local Administrator account is disabled
|
||||
- 1 - local Administrator account is enabled
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="localpoliciessecurityoptions-accounts-enableguestaccountstatus"></a>**LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This security setting determines if the Guest account is enabled or disabled.
|
||||
|
||||
Default: Disabled.
|
||||
|
||||
Note: If the Guest account is disabled and the security option Network Access: Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail.
|
||||
|
||||
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
<!--/Description-->
|
||||
<!--DbMapped-->
|
||||
GP Info:
|
||||
- GP English name: *Accounts: Guest account status*
|
||||
- GP path: *Windows Settings/Security Settings/Local Policies/Security Options*
|
||||
|
||||
<!--/DbMapped-->
|
||||
<!--SupportedValues-->
|
||||
Valid values:
|
||||
- 0 - local Guest account is disabled
|
||||
- 1 - local Guest account is enabled
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly"></a>**LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly**
|
||||
|
||||
|
||||
@ -280,7 +280,7 @@ Additionally, users may see blank tiles if logon was attempted without network c
|
||||
|
||||
### Symptom: Start Menu issues with Tile Data Layer corruption
|
||||
|
||||
**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database.
|
||||
**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database (The feature was deprecated in [Windows 10 1703](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update)).
|
||||
|
||||
**Resolution** There are steps you can take to fix the icons, first is to confirm that is the issue that needs to be addressed.
|
||||
|
||||
|
||||
@ -111,7 +111,7 @@ In either of these scenarios, you can make a variety of configuration changes to
|
||||
## Stay up to date
|
||||
|
||||
|
||||
For computers already running Windows 10 on the Current Branch or Current Branch for Business, new upgrades will periodically be deployed, approximately two to three times per year. You can deploy these upgrades by using a variety of methods:
|
||||
For computers already running Windows 10 on the Semi-Annual Channel, new upgrades will periodically be deployed, approximately two to three times per year. You can deploy these upgrades by using a variety of methods:
|
||||
|
||||
- Windows Update or Windows Update for Business, for devices where you want to receive updates directly from the Internet.
|
||||
|
||||
|
||||
@ -85,13 +85,13 @@ Starting with Windows 10, version 1709, the Windows Update for Business settings
|
||||
| Manage Windows Insider Preview builds | System/AllowBuildPreview | Update/ManagePreviewBuilds |
|
||||
| Manage when updates are received | Select when Feature Updates are received | Select when Preview Builds and Feature Updates are received (Update/BranchReadinessLevel) |
|
||||
|
||||
## Managing Windows Update for Business with Software Center Configuration Manager
|
||||
## Managing Windows Update for Business with System Center Configuration Manager
|
||||
|
||||
Starting with Windows 10, version 1709, you can assign a collection of devices to have dual scan enabled and manage that collection with Windows Update for Business policies. Starting with Windows 10, version 1809, you can set a collection of devices to receive the Windows Insider Preview Feature Updates from Windows Update from within Software Center Configuration Manager.
|
||||
Starting with Windows 10, version 1709, you can assign a collection of devices to have dual scan enabled and manage that collection with Windows Update for Business policies. Starting with Windows 10, version 1809, you can set a collection of devices to receive the Windows Insider Preview Feature Updates from Windows Update from within System Center Configuration Manager.
|
||||
|
||||
| Action | Windows 10 versions between 1709 and 1809 | Windows 10 versions after 1809 |
|
||||
| --- | --- | --- |
|
||||
| Manage Windows Update for Business in Configuration Manager | Manage Feature or Quality Updates with Windows Update for Business via Dual Scan | Manage Insider pre-release builds with Windows Update for Business within Software Center Configuration Manager |
|
||||
| Manage Windows Update for Business in Configuration Manager | Manage Feature or Quality Updates with Windows Update for Business via Dual Scan | Manage Insider pre-release builds with Windows Update for Business within System Center Configuration Manager |
|
||||
|
||||
## Managing Windows Update for Business with Windows Settings options
|
||||
Windows Settings includes options to control certain Windows Update for Business features:
|
||||
|
||||
@ -12,13 +12,13 @@ ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Windows error reporting
|
||||
# Windows Error Reporting
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
>[!NOTE]
|
||||
>This is a 300 level topic (moderately advanced).<br>
|
||||
> This is a 300 level topic (moderately advanced).
|
||||
> See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article.
|
||||
|
||||
|
||||
@ -26,7 +26,10 @@ When Windows Setup fails, the result and extend code are recorded as an informat
|
||||
|
||||
To use Windows PowerShell, type the following commands from an elevated Windows PowerShell prompt:
|
||||
|
||||
```
|
||||
>[!IMPORTANT]
|
||||
>}The following source will be available only if you have updated from a previous version of Windows 10 to a new version. If you installed the current version and have not updated, the source named **WinSetupDiag02** will be unavailable.
|
||||
|
||||
```Powershell
|
||||
$events = Get-WinEvent -FilterHashtable @{LogName="Application";ID="1001";Data="WinSetupDiag02"}
|
||||
$event = [xml]$events[0].ToXml()
|
||||
$event.Event.EventData.Data
|
||||
@ -40,19 +43,20 @@ To use Event Viewer:
|
||||
Note: For legacy operating systems, the Event Name was WinSetupDiag01.
|
||||
|
||||
Ten parameters are listed in the event:
|
||||
<br>
|
||||
<table border="0">
|
||||
<tr><td>P1: The Setup Scenario (1=Media,5=WindowsUpdate,7=Media Creation Tool)</td></tr>
|
||||
<tr><td>P2: Setup Mode (x=default,1=Downlevel,5=Rollback)</td></tr>
|
||||
<tr><td>P3: New OS Architecture (x=default,0=X86,9=AMD64)</td></tr>
|
||||
<tr><td>P4: Install Result (x=default,0=Success,1=Failure,2=Cancel,3=Blocked)</td></tr>
|
||||
<tr><td><b>P5: Result Error Code</b> (Ex: 0xc1900101)</td></tr>
|
||||
<tr><td><b>P6: Extend Error Code</b> (Ex: 0x20017)</td></tr>
|
||||
<tr><td>P7: Source OS build (Ex: 9600)</td></tr>
|
||||
<tr><td>P8: Source OS branch (not typically available)</td></tr>
|
||||
<tr><td>P9: New OS build (Ex: 16299}</td></tr>
|
||||
<tr><td>P10: New OS branch (Ex: rs3_release}</td></tr>
|
||||
</table>
|
||||
|
||||
| Parameters |
|
||||
| ------------- |
|
||||
|P1: The Setup Scenario (1=Media,5=WindowsUpdate,7=Media Creation Tool) |
|
||||
|P2: Setup Mode (x=default,1=Downlevel,5=Rollback) |
|
||||
|P3: New OS Architecture (x=default,0=X86,9=AMD64) |
|
||||
|P4: Install Result (x=default,0=Success,1=Failure,2=Cancel,3=Blocked) |
|
||||
|**P5: Result Error Code** (Ex: 0xc1900101) |
|
||||
|**P6: Extend Error Code** (Ex: 0x20017) |
|
||||
|P7: Source OS build (Ex: 9600) |
|
||||
|P8: Source OS branch (not typically available) |
|
||||
|P9: New OS build (Ex: 16299} |
|
||||
|P10: New OS branch (Ex: rs3_release} |
|
||||
|
||||
|
||||
The event will also contain links to log files that can be used to perform a detailed diagnosis of the error. An example of this event from a successful upgrade is shown below.
|
||||
|
||||
@ -61,7 +65,7 @@ The event will also contain links to log files that can be used to perform a det
|
||||
## Related topics
|
||||
|
||||
[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
|
||||
<br>[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
|
||||
<br>[Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications)
|
||||
<br>[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
|
||||
<br>[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
|
||||
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
|
||||
[Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications)
|
||||
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
|
||||
[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
|
||||
|
||||
@ -455,9 +455,9 @@ By default, all users are migrated. The only way to specify which users to inclu
|
||||
<p>USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /<strong>ue</strong> or /<strong>uel</strong> options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /<strong>all</strong> option, you cannot also use the /<strong>ui</strong>, /<strong>ue</strong> or /<strong>uel</strong> options.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>/<strong>ui</strong>:<em><DomainName></em>\<em><UserName></em></p>
|
||||
<td align="left"><p>/<strong>ui</strong>:<em><DomainName></em>\<em><UserName></em></p>
|
||||
<p>or</p>
|
||||
<p>/<strong>ui</strong>:<em><ComputerName></em>\<em><LocalUserName></em></p></td>
|
||||
<p>/<strong>ui</strong>:<em><ComputerName></em>\<em><LocalUserName></em></p></td>
|
||||
<td align="left"><p><strong>(User include)</strong></p>
|
||||
<p>Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /<strong>ue</strong> or /<strong>uel</strong> options. You can specify multiple /<strong>ui</strong> options, but you cannot use the /<strong>ui</strong> option with the /<strong>all</strong> option. <em>DomainName</em> and <em>UserName</em> can contain the asterisk (*) wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.</p>
|
||||
<div class="alert">
|
||||
@ -469,10 +469,10 @@ By default, all users are migrated. The only way to specify which users to inclu
|
||||
</div>
|
||||
<p>For example:</p>
|
||||
<ul>
|
||||
<li><p>To include only User2 from the Fabrikam domain, type:</p>
|
||||
<p><code>/ue:*\* /ui:fabrikam\user2</code></p></li>
|
||||
<li><p>To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type:</p>
|
||||
<p><code>/uel:30 /ui:fabrikam\*</code></p>
|
||||
<p>To include only User2 from the Fabrikam domain, type:</p>
|
||||
<p><code>/ue:*\* /ui:fabrikam\user2</code></p>
|
||||
<p>To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type:</p>
|
||||
<p><code>/uel:30 /ui:fabrikam\*</code></p>
|
||||
<p>In this example, a user account from the Contoso domain that was last modified 2 months ago will not be migrated.</p></li>
|
||||
</ul>
|
||||
<p>For more examples, see the descriptions of the /<strong>ue</strong> and /<strong>ui</strong> options in this table.</p></td>
|
||||
@ -500,17 +500,17 @@ By default, all users are migrated. The only way to specify which users to inclu
|
||||
<li><p><strong>/uel:2002/1/15</strong> migrates users who have logged on or been modified January 15, 2002 or afterwards.</p></li>
|
||||
</ul>
|
||||
<p>For example:</p>
|
||||
<p><code>scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0</code></p></td>
|
||||
<p><code>scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0</code></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>/<strong>ue</strong>:<em><DomainName></em>\<em><UserName></em></p>
|
||||
<td align="left"><p>/<strong>ue</strong>:<em><DomainName></em>\<em><UserName></em></p>
|
||||
<p>-or-</p>
|
||||
<p></p>
|
||||
<p>/<strong>ue</strong>:<em><ComputerName></em>\<em><LocalUserName></em></p></td>
|
||||
<p>/<strong>ue</strong>:<em><ComputerName></em>\<em><LocalUserName></em></p></td>
|
||||
<td align="left"><p><strong>(User exclude)</strong></p>
|
||||
<p>Excludes the specified users from the migration. You can specify multiple /<strong>ue</strong> options. You cannot use this option with the /<strong>all</strong> option. <em><DomainName></em> and <em><UserName></em> can contain the asterisk (*) wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.</p>
|
||||
<p>For example:</p>
|
||||
<p><code>scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1</code></p></td>
|
||||
<p><code>scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1</code></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
@ -548,15 +548,15 @@ The following examples apply to both the /**ui** and /**ue** options. You can re
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Exclude all domain users.</p></td>
|
||||
<td align="left"><p><code>/ue:Domain\*</code></p></td>
|
||||
<td align="left"><p><code>/ue:Domain\*</code></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Exclude all local users.</p></td>
|
||||
<td align="left"><p><code>/ue:%computername%\*</code></p></td>
|
||||
<td align="left"><p><code>/ue:%computername%\*</code></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Exclude users in all domains named User1, User2, and so on.</p></td>
|
||||
<td align="left"><p><code>/ue:*\user*</code></p></td>
|
||||
<td align="left"><p><code>/ue:*\user*</code></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
@ -586,23 +586,23 @@ The /**uel** option takes precedence over the /**ue** option. If a user has logg
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Include only User2 from the Fabrikam domain and exclude all other users.</p></td>
|
||||
<td align="left"><p><code>/ue:*\* /ui:fabrikam\user2</code></p></td>
|
||||
<td align="left"><p><code>/ue:*\* /ui:fabrikam\user2</code></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Include only the local user named User1 and exclude all other users.</p></td>
|
||||
<td align="left"><p><code>/ue:*\* /ui:user1</code></p></td>
|
||||
<td align="left"><p><code>/ue:*\* /ui:user1</code></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Include only the domain users from Contoso, except Contoso\User1.</p></td>
|
||||
<td align="left"><p>This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:</p>
|
||||
<ul>
|
||||
<li><p>On the <strong>ScanState</strong> command line, type: <code>/ue:*\* /ui:contoso\*</code></p></li>
|
||||
<li><p>On the <strong>ScanState</strong> command line, type: <code>/ue:*\* /ui:contoso\*</code></p></li>
|
||||
<li><p>On the <strong>LoadState</strong> command line, type: <code>/ue:contoso\user1</code></p></li>
|
||||
</ul></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Include only local (non-domain) users.</p></td>
|
||||
<td align="left"><p><code>/ue:*\* /ui:%computername%\*</code></p></td>
|
||||
<td align="left"><p><code>/ue:*\* /ui:%computername%\*</code></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
@ -25,8 +25,8 @@ IT admins can perform a local Windows Autopilot Reset to quickly remove personal
|
||||
|
||||
To enable local Autopilot Reset in Windows 10:
|
||||
|
||||
1. [Enable the policy for the feature](#enable-local-autopilot-reset)
|
||||
2. [Trigger a reset for each device](#trigger-local-autopilot-reset)
|
||||
1. [Enable the policy for the feature](#enable-local-windows-autopilot-reset)
|
||||
2. [Trigger a reset for each device](#trigger-local-windows-autopilot-reset)
|
||||
|
||||
## Enable local Windows Autopilot Reset
|
||||
|
||||
|
||||
@ -1,77 +0,0 @@
|
||||
### YamlMime:YamlDocument
|
||||
|
||||
documentType: LandingData
|
||||
title: Windows 10
|
||||
metadata:
|
||||
document_id:
|
||||
title: Windows 10
|
||||
description: Find tools, step-by-step guides, and other resources to help you deploy and support Windows 10 in your organization.
|
||||
keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
|
||||
ms.localizationpriority: medium
|
||||
author: lizap
|
||||
ms.author: elizapo
|
||||
manager: dougkim
|
||||
ms.topic: article
|
||||
ms.devlang: na
|
||||
|
||||
sections:
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Find tools, step-by-step guides, and other resources to help you deploy and support Windows 10 in your organization.
|
||||
"
|
||||
- title: Explore
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Get started with Windows 10. Evaluate free for 90 days, and set up virtual labs to test a proof of concept.<br>
|
||||
<table><tr><td><img src='images/explore1.png' width='192' height='192'><br>**Download a free 90-day evaluation**<br>Try the latest features. Test your apps, hardware, and deployment strategies.<br><a href='https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise'>Start evaluation</a></td><td><img src='images/explore2.png' width='192' height='192'><br>**Get started with virtual labs**<br>Try setup, deployment, and management scenarios in a virtual environment, with no additional software or setup required.<br><a href='https://www.microsoft.com/en-us/itpro/windows-10/virtual-labs'>See Windows 10 labs</a></td><td><img src='images/explore3.png' width='192' height='192'><br>**Conduct a proof of concept**<br>Download a lab environment with MDT, Configuration Manager, Windows 10, and more.<br><a href='https://go.microsoft.com/fwlink/p/?linkid=861441'>Get deployment kit</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
- title: What's new
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Learn about the latest releases and servicing options.<br>
|
||||
<table><tr><td><img src='images/land-new.png' width='384' height='384'></td><td><a href='https://docs.microsoft.com/en-us/windows/whats-new/whats-new-windows-10-version-1809'>What's new in Windows 10, version 1809</a><br><a href='https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803'>What's new in Windows 10, version 1803</a><br><a href='https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709'>What's new in Windows 10, version 1709</a><br><a href='https://docs.microsoft.com/windows/windows-10/release-information'>Windows 10 release information</a><br><a href='https://support.microsoft.com/help/12387/windows-10-update-history'>Windows 10 update history</a><br><a href='https://go.microsoft.com/fwlink/p/?linkid=861443'>Windows 10 roadmap</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
- title: Frequently asked questions
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Get answers to commom questions, or get help with a specific problem.<br>
|
||||
<table><tr><td><a href='https://docs.microsoft.com/windows/deployment/planning/windows-10-enterprise-faq-itpro'>Windows 10 FAQ for IT Pros</a><br><a href='https://go.microsoft.com/fwlink/p/?linkid=861444'>Windows 10 forums</a><br><a href='https://techcommunity.microsoft.com/t5/Windows-10/bd-p/Windows10space'>Windows 10 TechCommunity</a><br><a href='https://go.microsoft.com/fwlink/p/?linkid=861445'>Which edition is right for your organization?</a><br><a href='https://docs.microsoft.com/windows/deployment/planning/windows-10-infrastructure-requirements'>Infrastructure requirements</a><br><a href='https://www.microsoft.com/itpro/windows-10/windows-as-a-service'>What's Windows as a service?</a><br><a href='https://docs.microsoft.com/en-us/windows/client-management/windows-10-mobile-and-mdm'>Windows 10 Mobile deployment and management guide</a></td><td><img src='images/faq.png' width='384' height='384'></td></tr>
|
||||
</table>
|
||||
"
|
||||
- title: Plan
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Prepare to deploy Windows 10 in your organization. Explore deployment methods, compatibility tools, and servicing options. <br>
|
||||
<table><tr><td><img src='images/plan1.png' width='192' height='192'><br>**Application compatibility**<br>Get best practices and tools to help you address compatibility issues prior to deployment.<br><a href='https://www.readyforwindows.com/'>Find apps that are ready for Windows 10.</a><br><a href='https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness'>Identify and prioritize apps with Upgrade Readiness</a><br><a href='https://technet.microsoft.com/microsoft-edge/mt612809.aspx'>Test, validate, and implement with the Web Application Compatibility Lab Kit</a></td><td><img src='images/plan2.png' width='192' height='192'><br>**Upgrade options**<br>Learn about the options available for upgrading Windows 7, Windows 8, or Windows 8.1 PCs and devices to Windows 10.<br><a href='https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades'>Manage Windows upgrades with Upgrade Readiness</a><br><a href='https://docs.microsoft.com/windows/deployment/upgrade/windows-10-upgrade-paths'>Windows 10 upgrade paths</a><br><a href='https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades'>Windows 10 edition upgrades</a></td><td><img src='images/plan3.png' width='192' height='192'><br>**Windows as a service**<br>Windows as a service provides ongoing new capabilities and updates while maintaining a high level of hardware and software compatibility.<br><a href='https://docs.microsoft.com/windows/deployment/update/windows-as-a-service'>Explore</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
- title: Deploy
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Download recommended tools and get step-by-step guidance for in-place upgrades, dynamic provisioning, or traditional deployments.<br>
|
||||
<table><tr><td><img src='images/deploy1.png' width='192' height='192'><br>**In-place upgrade**<br>The simplest way to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 is to do an in-place upgrade.<br><a href='https://docs.microsoft.com/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager'>Upgrade to Windows 10 with Configuration Manager</a><br><a href='https://docs.microsoft.com/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit'>Upgrade to Windows 10 with MDT</a></td><td><img src='images/deploy2.png' width='192' height='192'><br>**Traditional deployment**<br>Some organizations may still need to opt for an image-based deployment of Windows 10.<br><a href='https://docs.microsoft.com/en-us/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems'>Deploy Windows 10 with Configuration Manager</a><br><a href='https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit'>Deploy Windows 10 with MDT</a></td></tr><tr><td><img src='images/deploy3.png' width='192' height='192'><br>**Dynamic provisioning**<br>With Windows 10 you can create provisioning packages that let you quickly configure a device without having to install a new image.<br><a href='https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages'>Provisioning packages for Windows 10</a><br><a href='https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package'>Build and apply a provisioning package</a><br><a href='https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd'>Customize Windows 10 start and the taskbar</a></td><td><img src='images/deploy4.png' width='192' height='192'><br>**Other deployment scenarios**<br>Get guidance on how to deploy Windows 10 for students, faculty, and guest users - and how to deploy line-of-business apps.<br><a href='https://docs.microsoft.com/education/windows/'>Windows deployment for education environments</a><br><a href='https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc'>Set up a shared or guest PC with Windows 10</a><br><a href='https://docs.microsoft.com/windows/application-management/sideload-apps-in-windows-10'>Sideload apps in Windows 10</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
- title: Management and security
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Learn how to manage Windows 10 clients and apps, secure company data, and manage risk.<br>
|
||||
<table><tr><td><img src='images/manage1.png' width='288' height='288'><br>**Manage Windows 10 updates**<br>Get best practices and tools to help you manage clients and apps.<br><a href='https://docs.microsoft.com/en-us/windows/client-management/'>Manage clients in Windows 10</a><br><a href='https://docs.microsoft.com/en-us/windows/application-management/'>Manage apps and features in Windows 10</a></td><td><img src='images/manage2.png' width='288' height='288'><br>**Security**<br>Intelligent security, powered by the cloud. Out-of-the-box protection, advanced security features, and intelligent management to respond to advanced threats.<br><a href='https://docs.microsoft.com/windows/security/index'>Windows 10 enterprise security</a><br><a href='https://docs.microsoft.com/windows/security/threat-protection'>Threat protection</a><br><a href='https://docs.microsoft.com/windows/access-protection'>Identity protection</a><br><a href='https://docs.microsoft.com/windows/security/information-protection'>Information protection</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
- title: Stay informed
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table><tr><td><img src='images/insider.png' width='192' height='192'><br>**Sign up for the Windows IT Pro Insider**<br>Find out about new resources and get expert tips and tricks on deployment, management, security, and more.<br><a href='https://aka.ms/windows-it-pro-insider'>Learn more</a></td><td><img src='images/twitter.png' width='192' height='192'><br>**Follow us on Twitter**<br>Keep up with the latest desktop and device trends, Windows news, and events for IT pros.<br><a href='https://twitter.com/MSWindowsITPro'>Visit Twitter</a></td><td><img src='images/wip4biz.png' width='192' height='192'><br>**Join the Windows Insider Program for Business**<br>Get early access to new builds and provide feedback on the latest features and functionalities.<br><a href='https://insider.windows.com/ForBusiness'>Get started</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
@ -158,7 +158,7 @@ The following table lists management options for each setting, beginning with Wi
|
||||
| [24.1 Windows Defender Smartscreen](#bkmk-defender-smartscreen) | |  |  |  | |
|
||||
| [25. Windows Spotlight](#bkmk-spotlight) |  |  |  |  | |
|
||||
| [26. Microsoft Store](#bkmk-windowsstore) | |  | |  | |
|
||||
| [27.1 Apps for websites](#bkmk-apps-for-websites) | |  | | |
|
||||
| [26.1 Apps for websites](#bkmk-apps-for-websites) | |  | | |
|
||||
| [27. Windows Update Delivery Optimization](#bkmk-updates) |  |  |  |  | |
|
||||
| [28. Windows Update](#bkmk-wu) |  |  |  | | |
|
||||
|
||||
@ -186,7 +186,7 @@ See the following table for a summary of the management settings for Windows Ser
|
||||
| [20. Teredo](#bkmk-teredo) | |  |  |  |
|
||||
| [24. Windows Defender](#bkmk-defender) | |  |  | |
|
||||
| [26. Microsoft Store](#bkmk-windowsstore) | |  |  | |
|
||||
| [27.1 Apps for websites](#bkmk-apps-for-websites) | |  | | |
|
||||
| [26.1 Apps for websites](#bkmk-apps-for-websites) | |  | | |
|
||||
| [28. Windows Update](#bkmk-wu) | |  |  | |
|
||||
|
||||
### Settings for Windows Server 2016 Server Core
|
||||
@ -268,7 +268,7 @@ See the following table for a summary of the management settings for Windows Ser
|
||||
| [24.1 Windows Defender Smartscreen](#bkmk-defender-smartscreen) | |  |  |  | |
|
||||
| [25. Windows Spotlight](#bkmk-spotlight) |  |  |  |  | |
|
||||
| [26. Microsoft Store](#bkmk-windowsstore) | |  | |  | |
|
||||
| [27.1 Apps for websites](#bkmk-apps-for-websites) | |  | | |
|
||||
| [26.1 Apps for websites](#bkmk-apps-for-websites) | |  | | |
|
||||
| [27. Windows Update Delivery Optimization](#bkmk-updates) |  |  |  |  | |
|
||||
| [28. Windows Update](#bkmk-wu) |  |  |  | | |
|
||||
|
||||
@ -768,7 +768,9 @@ To remove the News app:
|
||||
- Right-click the app in Start, and then click **Uninstall**.
|
||||
|
||||
-or-
|
||||
|
||||
>[!IMPORTANT]
|
||||
> If you have any issues with these commands, do a system reboot and try the scripts again.
|
||||
>
|
||||
- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}**
|
||||
|
||||
-and-
|
||||
|
||||
@ -32,8 +32,8 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Date resolved</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>OS Build 14393.2941<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494440' target='_blank'>KB4494440</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='360msg'></div><b>Zone transfers over TCP may fail</b><br>Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.<br><br><a href = '#360msgdesc'>See details ></a></td><td>OS Build 14393.2941<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494440' target='_blank'>KB4494440</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>OS Build 14393.2941<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494440' target='_blank'>KB4494440</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='191msg'></div><b>Custom URI schemes may not start corresponding application</b><br>Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.<br><br><a href = '#191msgdesc'>See details ></a></td><td>OS Build 14393.2848<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489882' target='_blank'>KB4489882</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='235msg'></div><b>End-user-defined characters (EUDC) may cause blue screen at startup</b><br>If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup. <br><br><a href = '#235msgdesc'>See details ></a></td><td>OS Build 14393.2879<br><br>March 19, 2019<br><a href ='https://support.microsoft.com/help/4489889' target='_blank'>KB4489889</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493470' target='_blank'>KB4493470</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='241msg'></div><b>Internet Explorer 11 authentication issue with multiple concurrent logons</b><br>Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.<br><br><a href = '#241msgdesc'>See details ></a></td><td>OS Build 14393.2724<br><br>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480961' target='_blank'>KB4480961</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493470' target='_blank'>KB4493470</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
@ -67,7 +67,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>OS Build 14393.2941<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494440' target='_blank'>KB4494440</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>OS Build 14393.2941<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494440' target='_blank'>KB4494440</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -32,7 +32,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Date resolved</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>OS Build 15063.1784<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493436' target='_blank'>KB4493436</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499181' target='_blank'>KB4499181</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>OS Build 15063.1784<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493436' target='_blank'>KB4493436</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499181' target='_blank'>KB4499181</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='190msg'></div><b>Custom URI schemes may not start corresponding application</b><br>Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.<br><br><a href = '#190msgdesc'>See details ></a></td><td>OS Build 15063.1689<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489871' target='_blank'>KB4489871</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493436' target='_blank'>KB4493436</a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='234msg'></div><b>End-user-defined characters (EUDC) may cause blue screen at startup</b><br>If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. <br><br><a href = '#234msgdesc'>See details ></a></td><td>OS Build 15063.1716<br><br>March 19, 2019<br><a href ='https://support.microsoft.com/help/4489888' target='_blank'>KB4489888</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493474' target='_blank'>KB4493474</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='222msg'></div><b>MSXML6 may cause applications to stop responding </b><br>MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().<br><br><a href = '#222msgdesc'>See details ></a></td><td>OS Build 15063.1563<br><br>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480973' target='_blank'>KB4480973</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493474' target='_blank'>KB4493474</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
@ -63,7 +63,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>OS Build 15063.1784<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493436' target='_blank'>KB4493436</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499181' target='_blank'>KB4499181</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>OS Build 15063.1784<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493436' target='_blank'>KB4493436</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499181' target='_blank'>KB4499181</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -32,8 +32,8 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Date resolved</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>OS Build 16299.1127<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499179' target='_blank'>KB4499179</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='361msg'></div><b>Zone transfers over TCP may fail</b><br>Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.<br><br><a href = '#361msgdesc'>See details ></a></td><td>OS Build 16299.1127<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499179' target='_blank'>KB4499179</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>OS Build 16299.1127<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499179' target='_blank'>KB4499179</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='347msg'></div><b>Custom URI schemes may not start corresponding application</b><br>Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.<br><br><a href = '#347msgdesc'>See details ></a></td><td>OS Build 16299.1029<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489886' target='_blank'>KB4489886</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='233msg'></div><b>End-user-defined characters (EUDC) may cause blue screen at startup</b><br>If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. <br><br><a href = '#233msgdesc'>See details ></a></td><td>OS Build 16299.1059<br><br>March 19, 2019<br><a href ='https://support.microsoft.com/help/4489890' target='_blank'>KB4489890</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493441' target='_blank'>KB4493441</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='221msg'></div><b>MSXML6 causes applications to stop responding if an exception was thrown</b><br>MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().<br><br><a href = '#221msgdesc'>See details ></a></td><td>OS Build 16299.904<br><br>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480978' target='_blank'>KB4480978</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493441' target='_blank'>KB4493441</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
@ -64,7 +64,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>OS Build 16299.1127<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499179' target='_blank'>KB4499179</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>OS Build 16299.1127<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499179' target='_blank'>KB4499179</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -32,8 +32,8 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Date resolved</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>OS Build 17134.753<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499167' target='_blank'>KB4499167</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='362msg'></div><b>Zone transfers over TCP may fail</b><br>Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.<br><br><a href = '#362msgdesc'>See details ></a></td><td>OS Build 17134.753<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499167' target='_blank'>KB4499167</a></td><td>May 14, 2019 <br>01:19 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>OS Build 17134.753<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499167' target='_blank'>KB4499167</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='188msg'></div><b>Custom URI schemes may not start corresponding application</b><br>Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.<br><br><a href = '#188msgdesc'>See details ></a></td><td>OS Build 17134.648<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489868' target='_blank'>KB4489868</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='232msg'></div><b>End-user-defined characters (EUDC) may cause blue screen at startup</b><br>If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup. <br><br><a href = '#232msgdesc'>See details ></a></td><td>OS Build 17134.677<br><br>March 19, 2019<br><a href ='https://support.microsoft.com/help/4489894' target='_blank'>KB4489894</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493464' target='_blank'>KB4493464</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='194msg'></div><b>First character of the Japanese era name not recognized</b><br>The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.<br><br><a href = '#194msgdesc'>See details ></a></td><td>OS Build 17134.556<br><br>January 15, 2019<br><a href ='https://support.microsoft.com/help/4480976' target='_blank'>KB4480976</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4487029' target='_blank'>KB4487029</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
@ -69,7 +69,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>OS Build 17134.753<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499167' target='_blank'>KB4499167</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>OS Build 17134.753<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499167' target='_blank'>KB4499167</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -32,8 +32,9 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Date resolved</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='376msg'></div><b>Windows 10, version 1809 update history may show an update installed twice</b><br>Some customers are reporting that KB4494441 installed twice on their device<br><br><a href = '#376msgdesc'>See details ></a></td><td>OS Build 17763.503<br><br>May 14, 2019<br><a href ='https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 15, 2019 <br>01:25 PM PT</td></tr>
|
||||
<tr><td><div id='373msg'></div><b>Zone transfers over TCP may fail</b><br>Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.<br><br><a href = '#373msgdesc'>See details ></a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>May 14, 2019 <br>01:19 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='355msg'></div><b>Latest cumulative update (KB 4495667) installs automatically</b><br>Reports that the optional cumulative update (KB 4495667) installs automatically.<br><br><a href = '#355msgdesc'>See details ></a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 08, 2019 <br>03:37 PM PT</td></tr>
|
||||
<tr><td><div id='352msg'></div><b>System may be unresponsive after restart if ArcaBit antivirus software installed</b><br>After further investigation ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809<br><br><a href = '#352msgdesc'>See details ></a></td><td>OS Build 17763.437<br><br>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493509' target='_blank'>KB4493509</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 08, 2019 <br>03:30 PM PT</td></tr>
|
||||
<tr><td><div id='349msg'></div><b>Custom URI schemes may not start corresponding application</b><br>Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.<br><br><a href = '#349msgdesc'>See details ></a></td><td>OS Build 17763.379<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489899' target='_blank'>KB4489899</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>May 03, 2019 <br>12:40 PM PT</td></tr>
|
||||
@ -75,8 +76,9 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='376msgdesc'></div><b>Windows 10, version 1809 update history may show an update installed twice</b><div><br></div><div><strong>Affected platforms</strong></div><ul><li>Client: Windows 10, version 1809</li><li>Server: TBD</li></ul><div></div><div><strong>Cause</strong></div><div>In certain situations, installing an update requires multiple download and restart steps. In cased where two intermediate steps of the installation complete successfully, the <strong>View your Update history</strong> page will report that installation completed successfully twice. </div><div><br></div><div><strong>Resolution</strong></div><div>No action is required on your part. The update installation may take longer and may require more than one restart, but will install successfully after all intermediate installation steps have completed. We are working on improving this update experience to ensure the <strong>Update history</strong> correctly reflects the installation of the latest cumulative update (LCU).</div><br><a href ='#376msg'>Back to top</a></td><td>OS Build 17763.503<br><br>May 14, 2019<br><a href ='https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>Resolved:<br>May 15, 2019 <br>01:25 PM PT<br><br>Opened:<br>May 14, 2019 <br>02:56 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='373msgdesc'></div><b>Zone transfers over TCP may fail</b><div>Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing <a href=\"https://support.microsoft.com/help/4495667\" target=\"_blank\">KB4495667</a>. </div><div> </div><div><strong>Affected platforms:</strong> </div><ul><li>Client: Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016 </li><li>Server: Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016 </li></ul><div></div><div><strong>Resolution:</strong> This issue was resolved in <a href=\"https://support.microsoft.com/help/4494441\" target=\"_blank\">KB4494441</a>.</div><br><a href ='#373msg'>Back to top</a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 14, 2019 <br>01:19 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='355msgdesc'></div><b>Latest cumulative update (KB 4495667) installs automatically</b><div>Due to a servicing side issue some users were offered <a href=\"https://support.microsoft.com/help/4495667\" target=\"_blank\">KB4495667</a> (optional update) automatically and rebooted devices. This issue has been mitigated.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019</li><li>Server: Windows Server, version 1809; Windows Server 2019</li></ul><div></div><div><strong>Resolution:</strong>:<strong> </strong>This issue has been mitigated on the servicing side to prevent auto installing of this update. Customers do not need to take any action.</div><div> </div><br><a href ='#355msg'>Back to top</a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>Resolved:<br>May 08, 2019 <br>03:37 PM PT<br><br>Opened:<br>May 05, 2019 <br>12:01 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
@ -35,7 +35,6 @@ sections:
|
||||
<tr><td><div id='372msg'></div><b>System may be unresponsive after restart if ArcaBit antivirus software installed</b><br>Devices with ArcaBit antivirus software installed may become unresponsive upon restart.<br><br><a href = '#372msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493472' target='_blank'>KB4493472</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:23 PM PT</td></tr>
|
||||
<tr><td><div id='370msg'></div><b>System unresponsive after restart if Sophos Endpoint Protection installed</b><br>Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.<br><br><a href = '#370msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493472' target='_blank'>KB4493472</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:22 PM PT</td></tr>
|
||||
<tr><td><div id='366msg'></div><b>System may be unresponsive after restart if Avira antivirus software installed</b><br>Devices with Avira antivirus software installed may become unresponsive upon restart.<br><br><a href = '#366msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493472' target='_blank'>KB4493472</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:21 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493453' target='_blank'>KB4493453</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499164' target='_blank'>KB4499164</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='357msg'></div><b>Authentication may fail for services after the Kerberos ticket expires</b><br>Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires.<br><br><a href = '#357msgdesc'>See details ></a></td><td>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489878' target='_blank'>KB4489878</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499164' target='_blank'>KB4499164</a></td><td>May 14, 2019 <br>01:17 PM PT</td></tr>
|
||||
<tr><td><div id='268msg'></div><b>Devices may not respond at login or Welcome screen if running certain Avast software</b><br>Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.<br><br><a href = '#268msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493472' target='_blank'>KB4493472</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='262msg'></div><b>Internet Explorer 11 authentication issue with multiple concurrent logons</b><br>Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.<br><br><a href = '#262msgdesc'>See details ></a></td><td>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480970' target='_blank'>KB4480970</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493472' target='_blank'>KB4493472</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
@ -60,15 +59,6 @@ sections:
|
||||
<div>
|
||||
</div>
|
||||
"
|
||||
- title: May 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493453' target='_blank'>KB4493453</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499164' target='_blank'>KB4499164</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
- title: April 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
|
||||
@ -32,10 +32,10 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Date resolved</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493443' target='_blank'>KB4493443</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499151' target='_blank'>KB4499151</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='371msg'></div><b>System may be unresponsive after restart if ArcaBit antivirus software installed</b><br>Devices with ArcaBit antivirus software installed may become unresponsive upon restart.<br><br><a href = '#371msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493446' target='_blank'>KB4493446</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:22 PM PT</td></tr>
|
||||
<tr><td><div id='369msg'></div><b>System unresponsive after restart if Sophos Endpoint Protection installed</b><br>Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.<br><br><a href = '#369msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493446' target='_blank'>KB4493446</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:22 PM PT</td></tr>
|
||||
<tr><td><div id='365msg'></div><b>System may be unresponsive after restart if Avira antivirus software installed</b><br>Devices with Avira antivirus software installed may become unresponsive upon restart.<br><br><a href = '#365msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493446' target='_blank'>KB4493446</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:21 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493443' target='_blank'>KB4493443</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499151' target='_blank'>KB4499151</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='284msg'></div><b>Devices may not respond at login or Welcome screen if running certain Avast software</b><br>Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.<br><br><a href = '#284msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493446' target='_blank'>KB4493446</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='273msg'></div><b>Internet Explorer 11 authentication issue with multiple concurrent logons</b><br>Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.<br><br><a href = '#273msgdesc'>See details ></a></td><td>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480963' target='_blank'>KB4480963</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493446' target='_blank'>KB4493446</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='274msg'></div><b>MSXML6 may cause applications to stop responding.</b><br>MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().<br><br><a href = '#274msgdesc'>See details ></a></td><td>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480963' target='_blank'>KB4480963</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493446' target='_blank'>KB4493446</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
@ -64,7 +64,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493443' target='_blank'>KB4493443</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499151' target='_blank'>KB4499151</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493443' target='_blank'>KB4493443</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499151' target='_blank'>KB4499151</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -35,7 +35,6 @@ sections:
|
||||
<tr><td><div id='368msg'></div><b>System unresponsive after restart if Sophos Endpoint Protection installed</b><br>Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.<br><br><a href = '#368msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493471' target='_blank'>KB4493471</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:21 PM PT</td></tr>
|
||||
<tr><td><div id='364msg'></div><b>System may be unresponsive after restart if Avira antivirus software installed</b><br>Devices with Avira antivirus software installed may become unresponsive upon restart.<br><br><a href = '#364msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493471' target='_blank'>KB4493471</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:19 PM PT</td></tr>
|
||||
<tr><td><div id='359msg'></div><b>Authentication may fail for services after the Kerberos ticket expires</b><br>Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires.<br><br><a href = '#359msgdesc'>See details ></a></td><td>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489880' target='_blank'>KB4489880</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499149' target='_blank'>KB4499149</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493460' target='_blank'>KB4493460</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499149' target='_blank'>KB4499149</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='295msg'></div><b>Embedded objects may display incorrectly</b><br>Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.<br><br><a href = '#295msgdesc'>See details ></a></td><td>February 12, 2019<br><a href ='https://support.microsoft.com/help/4487023' target='_blank'>KB4487023</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493471' target='_blank'>KB4493471</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='299msg'></div><b>NETDOM.EXE fails to run</b><br>NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen.<br><br><a href = '#299msgdesc'>See details ></a></td><td>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489880' target='_blank'>KB4489880</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493471' target='_blank'>KB4493471</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='296msg'></div><b>First character of the Japanese era name not recognized as an abbreviation</b><br>The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.<br><br><a href = '#296msgdesc'>See details ></a></td><td>January 17, 2019<br><a href ='https://support.microsoft.com/help/4480974' target='_blank'>KB4480974</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4489880' target='_blank'>KB4489880</a></td><td>March 12, 2019 <br>10:00 AM PT</td></tr>
|
||||
@ -54,15 +53,6 @@ sections:
|
||||
<div>
|
||||
</div>
|
||||
"
|
||||
- title: May 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493460' target='_blank'>KB4493460</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499149' target='_blank'>KB4499149</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
- title: April 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
|
||||
@ -32,9 +32,9 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Date resolved</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493462' target='_blank'>KB4493462</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499171' target='_blank'>KB4499171</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='367msg'></div><b>System unresponsive after restart if Sophos Endpoint Protection installed</b><br>Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.<br><br><a href = '#367msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493451' target='_blank'>KB4493451</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:21 PM PT</td></tr>
|
||||
<tr><td><div id='363msg'></div><b>System may be unresponsive after restart if Avira antivirus software installed</b><br>Devices with Avira antivirus software installed may become unresponsive upon restart.<br><br><a href = '#363msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493451' target='_blank'>KB4493451</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:19 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493462' target='_blank'>KB4493462</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499171' target='_blank'>KB4499171</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='308msg'></div><b>Internet Explorer 11 authentication issue with multiple concurrent logons</b><br>Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.<br><br><a href = '#308msgdesc'>See details ></a></td><td>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480975' target='_blank'>KB4480975</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493451' target='_blank'>KB4493451</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='307msg'></div><b>MSXML6 may cause applications to stop responding </b><br>MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().<br><br><a href = '#307msgdesc'>See details ></a></td><td>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480975' target='_blank'>KB4480975</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493451' target='_blank'>KB4493451</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='315msg'></div><b>Embedded objects may display incorrectly</b><br>Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.<br><br><a href = '#315msgdesc'>See details ></a></td><td>February 12, 2019<br><a href ='https://support.microsoft.com/help/4487025' target='_blank'>KB4487025</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493451' target='_blank'>KB4493451</a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
@ -61,7 +61,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493462' target='_blank'>KB4493462</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499171' target='_blank'>KB4499171</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493462' target='_blank'>KB4493462</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499171' target='_blank'>KB4499171</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -65,8 +65,8 @@ sections:
|
||||
<tr><td><div id='149msg'></div><b>SCVMM cannot enumerate and manage logical switches deployed on the host</b><br>For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host.<br><br><a href = '#149msgdesc'>See details ></a></td><td>OS Build 14393.2639<br><br>November 27, 2018<br><a href ='https://support.microsoft.com/help/4467684' target='_blank'>KB4467684</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='322msg'></div><b>Certain operations performed on a Cluster Shared Volume may fail</b><br>Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".<br><br><a href = '#322msgdesc'>See details ></a></td><td>OS Build 14393.2724<br><br>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480961' target='_blank'>KB4480961</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='142msg'></div><b>Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM</b><br>Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.<br><br><a href = '#142msgdesc'>See details ></a></td><td>OS Build 14393.2608<br><br>November 13, 2018<br><a href ='https://support.microsoft.com/help/4467691' target='_blank'>KB4467691</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>February 19, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>OS Build 14393.2941<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494440' target='_blank'>KB4494440</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='360msg'></div><b>Zone transfers over TCP may fail</b><br>Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.<br><br><a href = '#360msgdesc'>See details ></a></td><td>OS Build 14393.2941<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494440' target='_blank'>KB4494440</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>OS Build 14393.2941<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494440' target='_blank'>KB4494440</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='191msg'></div><b>Custom URI schemes may not start corresponding application</b><br>Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.<br><br><a href = '#191msgdesc'>See details ></a></td><td>OS Build 14393.2848<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489882' target='_blank'>KB4489882</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
@ -83,7 +83,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>OS Build 14393.2941<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494440' target='_blank'>KB4494440</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>OS Build 14393.2941<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493473' target='_blank'>KB4493473</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494440' target='_blank'>KB4494440</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -61,7 +61,7 @@ sections:
|
||||
text: "<div>This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.</div><br>
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Last updated</td></tr>
|
||||
<tr><td><div id='321msg'></div><b>Certain operations performed on a Cluster Shared Volume may fail</b><br>Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".<br><br><a href = '#321msgdesc'>See details ></a></td><td>OS Build 15063.1563<br><br>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480973' target='_blank'>KB4480973</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>OS Build 15063.1784<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493436' target='_blank'>KB4493436</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499181' target='_blank'>KB4499181</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>OS Build 15063.1784<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493436' target='_blank'>KB4493436</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499181' target='_blank'>KB4499181</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='190msg'></div><b>Custom URI schemes may not start corresponding application</b><br>Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.<br><br><a href = '#190msgdesc'>See details ></a></td><td>OS Build 15063.1689<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489871' target='_blank'>KB4489871</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493436' target='_blank'>KB4493436</a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
@ -78,7 +78,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>OS Build 15063.1784<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493436' target='_blank'>KB4493436</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499181' target='_blank'>KB4499181</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>OS Build 15063.1784<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493436' target='_blank'>KB4493436</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499181' target='_blank'>KB4499181</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -61,8 +61,8 @@ sections:
|
||||
text: "<div>This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.</div><br>
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Last updated</td></tr>
|
||||
<tr><td><div id='320msg'></div><b>Certain operations performed on a Cluster Shared Volume may fail</b><br>Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".<br><br><a href = '#320msgdesc'>See details ></a></td><td>OS Build 16299.904<br><br>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480978' target='_blank'>KB4480978</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>OS Build 16299.1127<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499179' target='_blank'>KB4499179</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='361msg'></div><b>Zone transfers over TCP may fail</b><br>Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.<br><br><a href = '#361msgdesc'>See details ></a></td><td>OS Build 16299.1127<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499179' target='_blank'>KB4499179</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>OS Build 16299.1127<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499179' target='_blank'>KB4499179</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='347msg'></div><b>Custom URI schemes may not start corresponding application</b><br>Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.<br><br><a href = '#347msgdesc'>See details ></a></td><td>OS Build 16299.1029<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489886' target='_blank'>KB4489886</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
@ -79,7 +79,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>OS Build 16299.1127<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499179' target='_blank'>KB4499179</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>OS Build 16299.1127<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493440' target='_blank'>KB4493440</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499179' target='_blank'>KB4499179</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -62,8 +62,8 @@ sections:
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Last updated</td></tr>
|
||||
<tr><td><div id='237msg'></div><b>Issue using PXE to start a device from WDS</b><br>Using PXE to start a device from a WDS server configured to use Variable Window Extension may cause the connection to the WDS server to terminate prematurely.<br><br><a href = '#237msgdesc'>See details ></a></td><td>OS Build 17134.648<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489868' target='_blank'>KB4489868</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='319msg'></div><b>Certain operations performed on a Cluster Shared Volume may fail</b><br>Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".<br><br><a href = '#319msgdesc'>See details ></a></td><td>OS Build 17134.523<br><br>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480966' target='_blank'>KB4480966</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>OS Build 17134.753<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499167' target='_blank'>KB4499167</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='362msg'></div><b>Zone transfers over TCP may fail</b><br>Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.<br><br><a href = '#362msgdesc'>See details ></a></td><td>OS Build 17134.753<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499167' target='_blank'>KB4499167</a></td><td>May 14, 2019 <br>01:19 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>OS Build 17134.753<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499167' target='_blank'>KB4499167</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='188msg'></div><b>Custom URI schemes may not start corresponding application</b><br>Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.<br><br><a href = '#188msgdesc'>See details ></a></td><td>OS Build 17134.648<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489868' target='_blank'>KB4489868</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
@ -80,7 +80,7 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>OS Build 17134.753<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499167' target='_blank'>KB4499167</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>OS Build 17134.753<br><br>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493437' target='_blank'>KB4493437</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499167' target='_blank'>KB4499167</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -65,14 +65,14 @@ sections:
|
||||
- type: markdown
|
||||
text: "<div>This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.</div><br>
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Last updated</td></tr>
|
||||
<tr><td><div id='375msg'></div><b>Windows 10, version 1809 Update Tuesday update may install twice</b><br>Some customers are reporting that KB4494441 installs twice<br><br><a href = '#375msgdesc'>See details ></a></td><td>OS Build 17763.502<br><br>May 14, 2019<br><a href ='https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Acknowledged<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>02:56 PM PT</td></tr>
|
||||
<tr><td><div id='346msg'></div><b>Devices with some Asian language packs installed may receive an error</b><br>After installing the KB4493509 devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_F<br><br><a href = '#346msgdesc'>See details ></a></td><td>OS Build 17763.437<br><br>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493509' target='_blank'>KB4493509</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>May 03, 2019 <br>10:59 AM PT</td></tr>
|
||||
<tr><td><div id='341msg'></div><b>Printing from Microsoft Edge or other UWP apps, you may receive the error 0x80070007</b><br>Attempting to print from Microsoft Edge or other Universal Windows Platform (UWP) applications, you may receive an error.<br><br><a href = '#341msgdesc'>See details ></a></td><td>OS Build 17763.379<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489899' target='_blank'>KB4489899</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>May 02, 2019 <br>04:47 PM PT</td></tr>
|
||||
<tr><td><div id='239msg'></div><b>Issue using PXE to start a device from WDS</b><br>Using PXE to start a device from a WDS server configured to use Variable Window Extension may cause the connection to the WDS server to terminate prematurely.<br><br><a href = '#239msgdesc'>See details ></a></td><td>OS Build 17763.379<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489899' target='_blank'>KB4489899</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='318msg'></div><b>Certain operations performed on a Cluster Shared Volume may fail </b><br>Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".<br><br><a href = '#318msgdesc'>See details ></a></td><td>OS Build 17763.253<br><br>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480116' target='_blank'>KB4480116</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 09, 2019 <br>10:00 AM PT</td></tr>
|
||||
<tr><td><div id='167msg'></div><b>Audio not working on monitors or TV connected to a PC via HDMI, USB, or DisplayPort</b><br>Upgrade block: Microsoft has identified issues with certain new Intel display drivers, which accidentally turn on unsupported features in Windows.<br><br><a href = '#167msgdesc'>See details ></a></td><td>OS Build 17763.134<br><br>November 13, 2018<br><a href ='https://support.microsoft.com/help/4467708' target='_blank'>KB4467708</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>March 15, 2019 <br>12:00 PM PT</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='376msg'></div><b>Windows 10, version 1809 update history may show an update installed twice</b><br>Some customers are reporting that KB4494441 installed twice on their device<br><br><a href = '#376msgdesc'>See details ></a></td><td>OS Build 17763.503<br><br>May 14, 2019<br><a href ='https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 15, 2019 <br>01:25 PM PT</td></tr>
|
||||
<tr><td><div id='373msg'></div><b>Zone transfers over TCP may fail</b><br>Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.<br><br><a href = '#373msgdesc'>See details ></a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>May 14, 2019 <br>01:19 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='355msg'></div><b>Latest cumulative update (KB 4495667) installs automatically</b><br>Reports that the optional cumulative update (KB 4495667) installs automatically.<br><br><a href = '#355msgdesc'>See details ></a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 08, 2019 <br>03:37 PM PT</td></tr>
|
||||
<tr><td><div id='352msg'></div><b>System may be unresponsive after restart if ArcaBit antivirus software installed</b><br>After further investigation ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809<br><br><a href = '#352msgdesc'>See details ></a></td><td>OS Build 17763.437<br><br>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493509' target='_blank'>KB4493509</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 08, 2019 <br>03:30 PM PT</td></tr>
|
||||
<tr><td><div id='349msg'></div><b>Custom URI schemes may not start corresponding application</b><br>Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.<br><br><a href = '#349msgdesc'>See details ></a></td><td>OS Build 17763.379<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489899' target='_blank'>KB4489899</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>May 03, 2019 <br>12:40 PM PT</td></tr>
|
||||
@ -91,11 +91,11 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='375msgdesc'></div><b>Windows 10, version 1809 Update Tuesday update may install twice</b><div>We are presently investigating and will provide an update when available.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809</li><li>Server: TBD</li></ul><div></div><div><br></div><br><a href ='#375msg'>Back to top</a></td><td>OS Build 17763.502<br><br>May 14, 2019<br><a href ='https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Acknowledged<br><a href = '' target='_blank'></a></td><td>Last updated:<br>May 14, 2019 <br>02:56 PM PT<br><br>Opened:<br>May 14, 2019 <br>02:56 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='346msgdesc'></div><b>Devices with some Asian language packs installed may receive an error</b><div>After installing the April 2019 Cumulative Update (<a href=\"https://support.microsoft.com/help/4493509\" target=\"_blank\">KB4493509</a>), devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019</li><li>Server: Windows Server, version 1809; Windows Server 2019</li></ul><div></div><div><strong>Workaround: </strong></div><ol><li>Uninstall and reinstall any recently added language packs. For instructions, see \"<a href=\"https://support.microsoft.com/help/4496404/windows-10-manage-the-input-and-display-language\" target=\"_blank\">Manage the input and display language settings in Windows 10</a>\".</li><li>Click <strong>Check for Updates</strong> and install the April 2019 Cumulative Update. For instructions, see \"<a href=\"https://support.microsoft.com/help/4027667/windows-10-update\" target=\"_blank\">Update Windows 10</a>\".</li></ol><div><strong>Note: </strong>If reinstalling the language pack does not mitigate the issue, reset your PC as follows:</div><ol><li class=\"ql-indent-1\">Go to <strong>Settings app</strong> -> <strong>Recovery</strong>.</li><li class=\"ql-indent-1\">Click on <strong>Get Started</strong> under <strong>\"Reset this PC\"</strong> recovery option.</li><li class=\"ql-indent-1\">Select <strong>\"Keep my Files\"</strong>.</li></ol><div><strong>Next steps: </strong>Microsoft is working on a resolution and will provide an update in an upcoming release.</div><br><a href ='#346msg'>Back to top</a></td><td>OS Build 17763.437<br><br>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493509' target='_blank'>KB4493509</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>Last updated:<br>May 03, 2019 <br>10:59 AM PT<br><br>Opened:<br>May 02, 2019 <br>04:36 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='341msgdesc'></div><b>Printing from Microsoft Edge or other UWP apps, you may receive the error 0x80070007</b><div>When attempting to print from Microsoft Edge or other Universal Windows Platform (UWP) applications you may receive the error, \"Your printer has experienced an unexpected configuration problem. 0x80070007e.\"</div><div> </div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019</li><li>Server: Windows Server, version 1809; Windows Server 2019</li></ul><div></div><div><strong>Workaround: </strong>You can use another browser, such as Internet Explorer to print your documents.</div><div> </div><div><strong>Next steps: </strong>Microsoft is working on a resolution and will provide an update in an upcoming release.</div><br><a href ='#341msg'>Back to top</a></td><td>OS Build 17763.379<br><br>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489899' target='_blank'>KB4489899</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>Last updated:<br>May 02, 2019 <br>04:47 PM PT<br><br>Opened:<br>May 02, 2019 <br>04:47 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='376msgdesc'></div><b>Windows 10, version 1809 update history may show an update installed twice</b><div><br></div><div><strong>Affected platforms</strong></div><ul><li>Client: Windows 10, version 1809</li><li>Server: TBD</li></ul><div></div><div><strong>Cause</strong></div><div>In certain situations, installing an update requires multiple download and restart steps. In cased where two intermediate steps of the installation complete successfully, the <strong>View your Update history</strong> page will report that installation completed successfully twice. </div><div><br></div><div><strong>Resolution</strong></div><div>No action is required on your part. The update installation may take longer and may require more than one restart, but will install successfully after all intermediate installation steps have completed. We are working on improving this update experience to ensure the <strong>Update history</strong> correctly reflects the installation of the latest cumulative update (LCU).</div><br><a href ='#376msg'>Back to top</a></td><td>OS Build 17763.503<br><br>May 14, 2019<br><a href ='https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>Resolved:<br>May 15, 2019 <br>01:25 PM PT<br><br>Opened:<br>May 14, 2019 <br>02:56 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='373msgdesc'></div><b>Zone transfers over TCP may fail</b><div>Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing <a href=\"https://support.microsoft.com/help/4495667\" target=\"_blank\">KB4495667</a>. </div><div> </div><div><strong>Affected platforms:</strong> </div><ul><li>Client: Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016 </li><li>Server: Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016 </li></ul><div></div><div><strong>Resolution:</strong> This issue was resolved in <a href=\"https://support.microsoft.com/help/4494441\" target=\"_blank\">KB4494441</a>.</div><br><a href ='#373msg'>Back to top</a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 14, 2019 <br>01:19 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4494441' target='_blank'>KB4494441</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='355msgdesc'></div><b>Latest cumulative update (KB 4495667) installs automatically</b><div>Due to a servicing side issue some users were offered <a href=\"https://support.microsoft.com/help/4495667\" target=\"_blank\">KB4495667</a> (optional update) automatically and rebooted devices. This issue has been mitigated.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019</li><li>Server: Windows Server, version 1809; Windows Server 2019</li></ul><div></div><div><strong>Resolution:</strong>:<strong> </strong>This issue has been mitigated on the servicing side to prevent auto installing of this update. Customers do not need to take any action.</div><div> </div><br><a href ='#355msg'>Back to top</a></td><td>OS Build 17763.475<br><br>May 03, 2019<br><a href ='https://support.microsoft.com/help/4495667' target='_blank'>KB4495667</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>Resolved:<br>May 08, 2019 <br>03:37 PM PT<br><br>Opened:<br>May 05, 2019 <br>12:01 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
@ -64,7 +64,6 @@ sections:
|
||||
<tr><td><div id='372msg'></div><b>System may be unresponsive after restart if ArcaBit antivirus software installed</b><br>Devices with ArcaBit antivirus software installed may become unresponsive upon restart.<br><br><a href = '#372msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493472' target='_blank'>KB4493472</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:23 PM PT</td></tr>
|
||||
<tr><td><div id='370msg'></div><b>System unresponsive after restart if Sophos Endpoint Protection installed</b><br>Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.<br><br><a href = '#370msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493472' target='_blank'>KB4493472</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:22 PM PT</td></tr>
|
||||
<tr><td><div id='366msg'></div><b>System may be unresponsive after restart if Avira antivirus software installed</b><br>Devices with Avira antivirus software installed may become unresponsive upon restart.<br><br><a href = '#366msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493472' target='_blank'>KB4493472</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:21 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493453' target='_blank'>KB4493453</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499164' target='_blank'>KB4499164</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='357msg'></div><b>Authentication may fail for services after the Kerberos ticket expires</b><br>Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires.<br><br><a href = '#357msgdesc'>See details ></a></td><td>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489878' target='_blank'>KB4489878</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499164' target='_blank'>KB4499164</a></td><td>May 14, 2019 <br>01:17 PM PT</td></tr>
|
||||
<tr><td><div id='268msg'></div><b>Devices may not respond at login or Welcome screen if running certain Avast software</b><br>Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.<br><br><a href = '#268msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493472' target='_blank'>KB4493472</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
</table>
|
||||
@ -77,15 +76,6 @@ sections:
|
||||
<div>
|
||||
</div>
|
||||
"
|
||||
- title: May 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493453' target='_blank'>KB4493453</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499164' target='_blank'>KB4499164</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
- title: April 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
|
||||
@ -60,13 +60,14 @@ sections:
|
||||
- type: markdown
|
||||
text: "<div>This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.</div><br>
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Last updated</td></tr>
|
||||
<tr><td><div id='378msg'></div><b>Japanese IME doesn't show the new Japanese Era name as a text input option</b><br>If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.<br><br><a href = '#378msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493443' target='_blank'>KB4493443</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>May 15, 2019 <br>05:53 PM PT</td></tr>
|
||||
<tr><td><div id='279msg'></div><b>Issue using PXE to start a device from WDS</b><br>There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.<br><br><a href = '#279msgdesc'>See details ></a></td><td>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489881' target='_blank'>KB4489881</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='285msg'></div><b>Certain operations performed on a Cluster Shared Volume may fail</b><br>Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.<br><br><a href = '#285msgdesc'>See details ></a></td><td>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480963' target='_blank'>KB4480963</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='336msg'></div><b>System may be unresponsive after restart with certain McAfee antivirus products</b><br>Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.<br><br><a href = '#336msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493446' target='_blank'>KB4493446</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 18, 2019 <br>05:00 PM PT</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493443' target='_blank'>KB4493443</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499151' target='_blank'>KB4499151</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='371msg'></div><b>System may be unresponsive after restart if ArcaBit antivirus software installed</b><br>Devices with ArcaBit antivirus software installed may become unresponsive upon restart.<br><br><a href = '#371msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493446' target='_blank'>KB4493446</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:22 PM PT</td></tr>
|
||||
<tr><td><div id='369msg'></div><b>System unresponsive after restart if Sophos Endpoint Protection installed</b><br>Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.<br><br><a href = '#369msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493446' target='_blank'>KB4493446</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:22 PM PT</td></tr>
|
||||
<tr><td><div id='365msg'></div><b>System may be unresponsive after restart if Avira antivirus software installed</b><br>Devices with Avira antivirus software installed may become unresponsive upon restart.<br><br><a href = '#365msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493446' target='_blank'>KB4493446</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:21 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493443' target='_blank'>KB4493443</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499151' target='_blank'>KB4499151</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='284msg'></div><b>Devices may not respond at login or Welcome screen if running certain Avast software</b><br>Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.<br><br><a href = '#284msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493446' target='_blank'>KB4493446</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
@ -83,7 +84,8 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493443' target='_blank'>KB4493443</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499151' target='_blank'>KB4499151</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='378msgdesc'></div><b>Japanese IME doesn't show the new Japanese Era name as a text input option</b><div>If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 8.1</li><li>Server: Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Workaround: </strong></div><div>If you see any of the previous dictionary updates listed below, uninstall it from <strong>Programs and features</strong> > <strong>Uninstall or change a program</strong>. New words that were in previous dictionary updates are also in this update.</div><ul><li>Update for Japanese Microsoft IME Standard Dictionary (15.0.2013)</li><li>Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.2013)</li><li>Update for Japanese Microsoft IME Standard Dictionary (15.0.1215)</li><li>Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1215)</li><li>Update for Japanese Microsoft IME Standard Dictionary (15.0.1080)</li><li>Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1080)</li></ul><br><a href ='#378msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493443' target='_blank'>KB4493443</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>Last updated:<br>May 15, 2019 <br>05:53 PM PT<br><br>Opened:<br>May 15, 2019 <br>05:53 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493443' target='_blank'>KB4493443</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499151' target='_blank'>KB4499151</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -63,7 +63,6 @@ sections:
|
||||
<tr><td><div id='368msg'></div><b>System unresponsive after restart if Sophos Endpoint Protection installed</b><br>Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.<br><br><a href = '#368msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493471' target='_blank'>KB4493471</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:21 PM PT</td></tr>
|
||||
<tr><td><div id='364msg'></div><b>System may be unresponsive after restart if Avira antivirus software installed</b><br>Devices with Avira antivirus software installed may become unresponsive upon restart.<br><br><a href = '#364msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493471' target='_blank'>KB4493471</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:19 PM PT</td></tr>
|
||||
<tr><td><div id='359msg'></div><b>Authentication may fail for services after the Kerberos ticket expires</b><br>Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires.<br><br><a href = '#359msgdesc'>See details ></a></td><td>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489880' target='_blank'>KB4489880</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499149' target='_blank'>KB4499149</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493460' target='_blank'>KB4493460</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499149' target='_blank'>KB4499149</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
@ -74,15 +73,6 @@ sections:
|
||||
<div>
|
||||
</div>
|
||||
"
|
||||
- title: May 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493460' target='_blank'>KB4493460</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499149' target='_blank'>KB4499149</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
- title: April 2019
|
||||
- items:
|
||||
- type: markdown
|
||||
|
||||
@ -60,11 +60,12 @@ sections:
|
||||
- type: markdown
|
||||
text: "<div>This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.</div><br>
|
||||
<table border ='0'><tr><td width='65%'>Summary</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>Last updated</td></tr>
|
||||
<tr><td><div id='378msg'></div><b>Japanese IME doesn't show the new Japanese Era name as a text input option</b><br>If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.<br><br><a href = '#378msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493462' target='_blank'>KB4493462</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>May 15, 2019 <br>05:53 PM PT</td></tr>
|
||||
<tr><td><div id='311msg'></div><b>Issue using PXE to start a device from WDS</b><br>There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.<br><br><a href = '#311msgdesc'>See details ></a></td><td>March 12, 2019<br><a href ='https://support.microsoft.com/help/4489891' target='_blank'>KB4489891</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='314msg'></div><b>Certain operations performed on a Cluster Shared Volume may fail</b><br>Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.<br><br><a href = '#314msgdesc'>See details ></a></td><td>January 08, 2019<br><a href ='https://support.microsoft.com/help/4480975' target='_blank'>KB4480975</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>April 25, 2019 <br>02:00 PM PT</td></tr>
|
||||
<tr><td><div id='379msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#379msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493462' target='_blank'>KB4493462</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499171' target='_blank'>KB4499171</a></td><td>May 15, 2019 <br>05:55 PM PT</td></tr>
|
||||
<tr><td><div id='367msg'></div><b>System unresponsive after restart if Sophos Endpoint Protection installed</b><br>Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.<br><br><a href = '#367msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493451' target='_blank'>KB4493451</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:21 PM PT</td></tr>
|
||||
<tr><td><div id='363msg'></div><b>System may be unresponsive after restart if Avira antivirus software installed</b><br>Devices with Avira antivirus software installed may become unresponsive upon restart.<br><br><a href = '#363msgdesc'>See details ></a></td><td>April 09, 2019<br><a href ='https://support.microsoft.com/help/4493451' target='_blank'>KB4493451</a></td><td>Resolved<br><a href = '' target='_blank'></a></td><td>May 14, 2019 <br>01:19 PM PT</td></tr>
|
||||
<tr><td><div id='358msg'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><br>When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. <br><br><a href = '#358msgdesc'>See details ></a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493462' target='_blank'>KB4493462</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499171' target='_blank'>KB4499171</a></td><td>May 14, 2019 <br>01:18 PM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
@ -80,7 +81,8 @@ sections:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table border ='0'><tr><td width='65%'>Details</td><td width='15%'>Originating update</td><td width='10%'>Status</td><td width='10%'>History</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='358msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 </li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 </li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#358msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493462' target='_blank'>KB4493462</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499171' target='_blank'>KB4499171</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='378msgdesc'></div><b>Japanese IME doesn't show the new Japanese Era name as a text input option</b><div>If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 8.1</li><li>Server: Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Workaround: </strong></div><div>If you see any of the previous dictionary updates listed below, uninstall it from <strong>Programs and features</strong> > <strong>Uninstall or change a program</strong>. New words that were in previous dictionary updates are also in this update.</div><ul><li>Update for Japanese Microsoft IME Standard Dictionary (15.0.2013)</li><li>Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.2013)</li><li>Update for Japanese Microsoft IME Standard Dictionary (15.0.1215)</li><li>Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1215)</li><li>Update for Japanese Microsoft IME Standard Dictionary (15.0.1080)</li><li>Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1080)</li></ul><br><a href ='#378msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493462' target='_blank'>KB4493462</a></td><td>Mitigated<br><a href = '' target='_blank'></a></td><td>Last updated:<br>May 15, 2019 <br>05:53 PM PT<br><br>Opened:<br>May 15, 2019 <br>05:53 PM PT</td></tr>
|
||||
<tr><td style='border-left-width:1px;border-right-width:1px;border-bottom-width:1px;'><div id='379msgdesc'></div><b>Layout and cell size of Excel sheets may change when using MS UI Gothic </b><div>When using the <strong>MS UI Gothic</strong> or <strong>MS PGothic</strong> fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using <strong>MS</strong> <strong>UI Gothic</strong>.</div><div><br></div><div><strong>Affected platforms:</strong></div><ul><li>Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1</li><li>Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012</li></ul><div></div><div><strong>Resolution</strong>: This issue has been resolved.</div><br><a href ='#379msg'>Back to top</a></td><td>April 25, 2019<br><a href ='https://support.microsoft.com/help/4493462' target='_blank'>KB4493462</a></td><td>Resolved<br><a href = 'https://support.microsoft.com/help/4499171' target='_blank'>KB4499171</a></td><td>Resolved:<br>May 14, 2019 <br>10:00 AM PT<br><br>Opened:<br>May 10, 2019 <br>10:35 AM PT</td></tr>
|
||||
</table>
|
||||
"
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 10/13/2017
|
||||
|
||||
This topic for the IT professional explains how a Microsoft account works to enhance security and privacy for users, and how you can manage this consumer account type in your organization.
|
||||
|
||||
Microsoft sites, services, and properties, as well as computers running Windows 10, can use a Microsoft account as a mean of identifying a user. Microsoft account was previously called Windows Live ID. It has user-defined secrets, and consists of a unique email address and a password.
|
||||
Microsoft sites, services, and properties, as well as computers running Windows 10, can use a Microsoft account as a means of identifying a user. Microsoft account was previously called Windows Live ID. It has user-defined secrets, and consists of a unique email address and a password.
|
||||
|
||||
When a user signs in with a Microsoft account, the device is connected to cloud services. Many of the user's settings, preferences, and apps can be shared across devices.
|
||||
|
||||
|
||||
@ -252,7 +252,7 @@ Contains numeric value ranging from 0 to 100 to represent the wireless network's
|
||||
<sig_quality>80</sig_quality>
|
||||
```
|
||||
|
||||
### Sample Trusted Signal Congfigurations
|
||||
### Sample Trusted Signal Configurations
|
||||
|
||||
These examples are wrapped for readability. Once properly formatted, the entire XML contents must be a single line.
|
||||
|
||||
|
||||
@ -66,7 +66,7 @@ Sign-in a domain controller or management workstation with domain administrator
|
||||
|
||||
The Windows Hello for Business Users group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy and Certificate template permissions to this group to simplify the deployment by simply adding the users to the group. This provides them the proper permissions to provision Windows Hello for Business and to enroll in the Windows Hello for Business authentication certificate.
|
||||
|
||||
Sign-in a domain controller or management workstation with domain administrator equivalent credentials.
|
||||
Sign into a domain controller or management workstation with domain administrator equivalent credentials.
|
||||
|
||||
1. Open **Active Directory Users and Computers**.
|
||||
2. Click **View** and click **Advanced Features**.
|
||||
|
||||
@ -42,7 +42,7 @@ A lab or proof-of-concept environment does not need high-availability or scalabi
|
||||
Please follow [Download the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#download-the-azure-multi-factor-authentication-server) to download Azure MFA server.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Make sure to validate the requirements for Azure MFA server, as outlined in [Install and Configure the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#install-and-configure-the-azure-multi-factor-authentication-server) before proceeding. Do not use instllation instructions provided in the article.
|
||||
>Make sure to validate the requirements for Azure MFA server, as outlined in [Install and Configure the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#install-and-configure-the-azure-multi-factor-authentication-server) before proceeding. Do not use installation instructions provided in the article.
|
||||
|
||||
Once you have validated all the requirements, please proceed to [Configure or Deploy Multifactor Authentication Services](hello-cert-trust-deploy-mfa.md).
|
||||
|
||||
|
||||
@ -67,7 +67,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong,
|
||||
|C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Azure Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Azure Active Directory returns a key ID to the application which signals the end of user provisioning and the application exits.|
|
||||
|D | Azure AD Connect requests updates on its next synchronization cycle. Azure Active Directory sends the user's public key that was securely registered through provisioning. AAD Connect receives the public key and writes it to user's msDS-KeyCredentialLink attribute in Active Directory.|
|
||||
> [!IMPORTANT]
|
||||
> The newly provisionied user will not be able to sign in using Windows Hello for Business until Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory.
|
||||
> The newly provisioned user will not be able to sign in using Windows Hello for Business until Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory.
|
||||
|
||||
|
||||
|
||||
@ -87,7 +87,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong,
|
||||
|H | The application receives the newly issued certificate and installs the it into the Personal store of the user. This signals the end of provisioning.|
|
||||
|F | Azure AD Connect requests updates on its next synchronization cycle. Azure Active Directory sends the user's public key that was securely registered through provisioning. AAD Connect receives the public key and writes it to user's msDS-KeyCredentialLink attribute in Active Directory.|
|
||||
> [!IMPORTANT]
|
||||
> The newly provisionied user will not be able to sign in using Windows Hello for Business until Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory.
|
||||
> The newly provisioned user will not be able to sign in using Windows Hello for Business until Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory.
|
||||
|
||||
|
||||
[Return to top](#windows-hello-for-business-provisioning)
|
||||
@ -104,12 +104,12 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong,
|
||||
|F |The registration authority sends the certificate request to the enterprise issuing certificate authority. The certificate authority validates the certificate request is signed by a valid enrollment agent and, on success, issues a certificate and returns it to the registration authority that then returns the certificate to the application.|
|
||||
|G | The application receives the newly issued certificate and installs the it into the Personal store of the user. This signals the end of provisioning.|
|
||||
> [!IMPORTANT]
|
||||
> Synchronous certificate enrollment does not depend on Azure AD Connect to syncrhonize the user's public key to issue the Windows Hello for Business authentication certificate. Users can sign-in using the certificate immediately after provisioning completes. Azure AD Connect continues to synchronize the public key to Active Directory, but is not show in this flow.
|
||||
> Synchronous certificate enrollment does not depend on Azure AD Connect to synchronize the user's public key to issue the Windows Hello for Business authentication certificate. Users can sign-in using the certificate immediately after provisioning completes. Azure AD Connect continues to synchronize the public key to Active Directory, but is not shown in this flow.
|
||||
|
||||
|
||||
[Return to top](#windows-hello-for-business-provisioning)
|
||||
## Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment
|
||||
|
||||
|
||||
|
||||
| Phase | Description |
|
||||
| :----: | :----------- |
|
||||
@ -121,7 +121,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong,
|
||||
|F |The registration authority sends the certificate request to the enterprise issuing certificate authority. The certificate authority validates the certificate request is signed by a valid enrollment agent and, on success, issues a certificate and returns it to the registration authority that then returns the certificate to the application.|
|
||||
|G | The application receives the newly issued certificate and installs the it into the Personal store of the user. This signals the end of provisioning.|
|
||||
> [!IMPORTANT]
|
||||
> Synchronous certificate enrollment does not depend on Azure AD Connect to syncrhonize the user's public key to issue the Windows Hello for Business authentication certificate. Users can sign-in using the certificate immediately after provisioning completes. Azure AD Connect continues to synchronize the public key to Active Directory, but is not show in this flow.
|
||||
> Synchronous certificate enrollment does not depend on Azure AD Connect to synchronize the user's public key to issue the Windows Hello for Business authentication certificate. Users can sign-in using the certificate immediately after provisioning completes. Azure AD Connect continues to synchronize the public key to Active Directory, but is not shown in this flow.
|
||||
|
||||
[Return to top](#windows-hello-for-business-provisioning)
|
||||
## Domain joined provisioning in an On-premises Key Trust deployment
|
||||
|
||||
@ -43,6 +43,6 @@ Provision can occur automatically through the out-of-box-experience (OOBE) on Az
|
||||
|
||||
## Authentication
|
||||
|
||||
Authentication using Windows Hello for Business is the goal, and the first step in getting to a passwordless environment. With the device registered, and provisioning complete. Users can sign-in to Windows 10 using biometrics or a PIN. PIN is the most common gesture and is avaiable on most computers and devices. Regardless of the gesture used, authentication occurs using the private portion of the Windows Hello for Business credential. The PIN nor the private portion of the credential are never sent to the identity provider, and the PIN is not stored on the device. It is user provided entropy when performing operations that use the private portion of the credential.
|
||||
Authentication using Windows Hello for Business is the goal, and the first step in getting to a passwordless environment. With the device registered, and provisioning complete. Users can sign-in to Windows 10 using biometrics or a PIN. PIN is the most common gesture and is available on most computers and devices. Regardless of the gesture used, authentication occurs using the private portion of the Windows Hello for Business credential. The PIN nor the private portion of the credential are never sent to the identity provider, and the PIN is not stored on the device. It is user provided entropy when performing operations that use the private portion of the credential.
|
||||
|
||||
[How Windows Hello for Business authentication works](hello-how-it-works-authentication.md)
|
||||
|
||||
@ -24,6 +24,7 @@ ms.date: 10/08/2018
|
||||
- [Azure AD Registered](#azure-ad-registered)
|
||||
- [Certificate Trust](#certificate-trust)
|
||||
- [Cloud Deployment](#cloud-deployment)
|
||||
- [Cloud Experience Host](#cloud-experience-host)
|
||||
- [Deployment Type](#deployment-type)
|
||||
- [Endorsement Key](#endorsement-key)
|
||||
- [Federated Environment](#federated-environment)
|
||||
@ -99,6 +100,17 @@ The Windows Hello for Business Cloud deployment is exclusively for organizations
|
||||
[Azure AD Joined](#azure-ad-joined), [Azure AD Registered](#azure-ad-registered), [Deployment Type](#deployment-type), [Join Type](#join-type)
|
||||
|
||||
[Return to Top](hello-how-it-works-technology.md)
|
||||
## Cloud Experience Host
|
||||
In Windows 10, Cloud Experience Host is an application used while joining the workplace environment or Azure AD for rendering the experience when collecting your company-provided credentials. Once you enroll your device to your workplace environment or Azure AD, your organization will be able to manage your PC and collect information about you (including your location). It might add or remove apps or content, change settings, disable features, prevent you from removing your company account, or reset your PC.
|
||||
|
||||
### Related topics
|
||||
[Windows Hello for Business](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-identity-verification), [Managed Windows Hello in Organization](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-manage-in-organization)
|
||||
|
||||
### More information
|
||||
- [Windows Hello for Business and Device Registration](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration)
|
||||
|
||||
[Return to Top](hello-how-it-works-technology.md)
|
||||
|
||||
## Deployment Type
|
||||
Windows Hello for Business has three deployment models to accommodate the needs of different organizations. The three deployment models include:
|
||||
- Cloud
|
||||
@ -317,5 +329,3 @@ In a simplified manner, the TPM is a passive component with limited resources. I
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -69,8 +69,8 @@ To include the on-premises distinguished name in the certificate's subject, Azur
|
||||
### Verify AAD Connect version
|
||||
Sign-in to computer running Azure AD Connect with access equivalent to _local administrator_.
|
||||
|
||||
1. Open **Syncrhonization Services** from the **Azure AD Connect** folder.
|
||||
2. In the **Syncrhonization Service Manager**, click **Help** and then click **About**.
|
||||
1. Open **Synchronization Services** from the **Azure AD Connect** folder.
|
||||
2. In the **Synchronization Service Manager**, click **Help** and then click **About**.
|
||||
3. If the version number is not **1.1.819** or later, then upgrade Azure AD Connect to the latest version.
|
||||
|
||||
### Verify the onPremisesDistinguishedName attribute is synchronized
|
||||
@ -172,7 +172,7 @@ You must prepare the public key infrastructure and the issuing certificate autho
|
||||
When deploying certificates using Microsoft Intune, you have the option of providing the validity period in the SCEP certificate profile rather than relying on the validity period in the certificate template. If you need to issue the same certificate with different validity periods, it may be advantageous to use the SCEP profile, given the limited number of certificates a single NDES server can issue.
|
||||
|
||||
> [!NOTE]
|
||||
> Skip this step if you do not want to enable Microsoft Intune to specify the validity period of the certificate. Without this configuiration, the certificate request uses the validity period configured in the certificate template.
|
||||
> Skip this step if you do not want to enable Microsoft Intune to specify the validity period of the certificate. Without this configuration, the certificate request uses the validity period configured in the certificate template.
|
||||
|
||||
Sign-in to the issuing certificate authority with access equivalent to _local administrator_.
|
||||
|
||||
@ -222,7 +222,7 @@ Sign-in a certificate authority or management workstations with _Domain Admin eq
|
||||
The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate.
|
||||
|
||||
> [!Important]
|
||||
> Ensure you publish the **AADJ WHFB Authentication** certificate templates to the certificate authority that Microsoft Intune uses by way of the NDES servers. The NDES configuration asks you to choose a certificate authority from which it requests certificates. You need to publish that cerificate templates to that issuing certificate authority. The **NDES-Intune Authentication** certificate is directly enrolled and can be published to any certificate authority.
|
||||
> Ensure you publish the **AADJ WHFB Authentication** certificate templates to the certificate authority that Microsoft Intune uses by way of the NDES servers. The NDES configuration asks you to choose a certificate authority from which it requests certificates. You need to publish that certificate templates to that issuing certificate authority. The **NDES-Intune Authentication** certificate is directly enrolled and can be published to any certificate authority.
|
||||
|
||||
Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials.
|
||||
|
||||
@ -373,7 +373,7 @@ where **registryValueName** is one of the three value names from the above table
|
||||
5. Close the command prompt.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Use the **name** of the certificate template; not the **display name**. The certificate template name does not include spaces. You can view the certificate names by looking at the **General** tab of the certificate template's properties in the **Certifcates Templates** management console (certtmpl.msc).
|
||||
> Use the **name** of the certificate template; not the **display name**. The certificate template name does not include spaces. You can view the certificate names by looking at the **General** tab of the certificate template's properties in the **Certificates Templates** management console (certtmpl.msc).
|
||||
|
||||
### Create a Web Application Proxy for the internal NDES URL.
|
||||
Certificate enrollment for Azure AD joined devices occurs over the Internet. As a result, the internal NDES URLs must be accessible externally. You can do this easily and securely using Azure Active Directory Application Proxy. Azure AD Application Proxy provides single sign-on and secure remote access for web applications hosted on-premises, such as Network Device Enrollment Services.
|
||||
@ -425,7 +425,7 @@ Sign-in a workstation with access equivalent to a _domain user_.
|
||||
3. Under **MANAGE**, click **Application proxy**.
|
||||
4. Click **Configure an app**.
|
||||
5. Under **Basic Settings** next to **Name**, type **WHFB NDES 01**. Choose a name that correlates this Azure AD Application Proxy setting with the on-premises NDES server. Each NDES server must have its own Azure AD Application Proxy as two NDES servers cannot share the same internal URL.
|
||||
6. Next to **Internal Url**, type the internal fully qualified DNS name of the NDES server associated with this Azure AD Application Proxy. For example, https://ndes.corp.mstepdemo.net). This must match the internal DNS name of the NDES server and ensure you prefix the Url with **https**.
|
||||
6. Next to **Internal Url**, type the internal, fully qualified DNS name of the NDES server associated with this Azure AD Application Proxy. For example, https://ndes.corp.mstepdemo.net). You need to match the primary host name (AD Computer Account name) of the NDES server, and prefix the URL with **https**.
|
||||
7. Under **Internal Url**, select **https://** from the first list. In the text box next to **https://**, type the hostname you want to use as your external hostname for the Azure AD Application Proxy. In the list next to the hostname you typed, select a DNS suffix you want to use externally for the Azure AD Application Proxy. It is recommended to use the default, -[tenantName].msapproxy.net where **[tenantName]** is your current Azure Active Directory tenant name (-mstephendemo.msappproxy.net).
|
||||
|
||||
8. Select **Passthrough** from the **Pre Authentication** list.
|
||||
|
||||
@ -74,7 +74,7 @@ Sign-in a domain controller or management workstation with *Domain Admin* equiva
|
||||
|
||||
## Follow the Windows Hello for Business hybrid certificate trust deployment guide
|
||||
1. [Overview](hello-hybrid-cert-trust.md)
|
||||
2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md)
|
||||
2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md)
|
||||
3. [New Installation Baseline](hello-hybrid-cert-new-install.md)
|
||||
4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md)
|
||||
5. Configure Windows Hello for Business settings: Active Directory (*You are here*)
|
||||
|
||||
@ -73,7 +73,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
|
||||
## Follow the Windows Hello for Business hybrid certificate trust deployment guide
|
||||
1. [Overview](hello-hybrid-cert-trust.md)
|
||||
2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md)
|
||||
2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md)
|
||||
3. [New Installation Baseline](hello-hybrid-cert-new-install.md)
|
||||
4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md)
|
||||
5. Configure Windows Hello for Business settings: AD FS (*You are here*)
|
||||
|
||||
@ -79,7 +79,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
|
||||
## Follow the Windows Hello for Business hybrid certificate trust deployment guide
|
||||
1. [Overview](hello-hybrid-cert-trust.md)
|
||||
2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md)
|
||||
2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md)
|
||||
3. [New Installation Baseline](hello-hybrid-cert-new-install.md)
|
||||
4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md)
|
||||
5. Configure Windows Hello for Business settings: Directory Synchronization (*You are here*)
|
||||
|
||||
@ -203,7 +203,7 @@ Sign-in to the certificate authority or management workstation with _Enterprise
|
||||
|
||||
## Follow the Windows Hello for Business hybrid certificate trust deployment guide
|
||||
1. [Overview](hello-hybrid-cert-trust.md)
|
||||
2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md)
|
||||
2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md)
|
||||
3. [New Installation Baseline](hello-hybrid-cert-new-install.md)
|
||||
4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md)
|
||||
5. Configure Windows Hello for Business settings: PKI (*You are here*)
|
||||
|
||||
@ -197,7 +197,7 @@ Users must receive the Windows Hello for Business group policy settings and have
|
||||
|
||||
## Follow the Windows Hello for Business hybrid certificate trust deployment guide
|
||||
1. [Overview](hello-hybrid-cert-trust.md)
|
||||
2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md)
|
||||
2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md)
|
||||
3. [New Installation Baseline](hello-hybrid-cert-new-install.md)
|
||||
4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md)
|
||||
5. Configure Windows Hello for Business policy settings (*You are here*)
|
||||
|
||||
@ -27,7 +27,7 @@ Hybrid environments are distributed systems that enable organizations to use on-
|
||||
|
||||
The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include:
|
||||
* [Directories](#directories)
|
||||
* [Public Key Infrastucture](#public-key-infastructure)
|
||||
* [Public Key Infrastructure](#public-key-infastructure)
|
||||
* [Directory Synchronization](#directory-synchronization)
|
||||
* [Federation](#federation)
|
||||
* [MultiFactor Authentication](#multifactor-authentication)
|
||||
@ -118,9 +118,9 @@ Organizations wanting to deploy hybrid key trust need their domain joined device
|
||||
<br>
|
||||
|
||||
### Next Steps ###
|
||||
Follow the Windows Hello for Business hybrid key trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Basline**.
|
||||
Follow the Windows Hello for Business hybrid key trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Baseline**.
|
||||
|
||||
For environments transitioning from on-premises to hybrid, start with **Configure Azure Directory Syncrhonization**.
|
||||
For environments transitioning from on-premises to hybrid, start with **Configure Azure Directory Synchronization**.
|
||||
|
||||
For federated and non-federated environments, start with **Configure Windows Hello for Business settings**.
|
||||
|
||||
|
||||
@ -58,7 +58,7 @@ Sign-in a domain controller or management workstation with *Domain Admin* equiva
|
||||
|
||||
## Follow the Windows Hello for Business hybrid key trust deployment guide
|
||||
1. [Overview](hello-hybrid-cert-trust.md)
|
||||
2. [Prerequistes](hello-hybrid-key-trust-prereqs.md)
|
||||
2. [Prerequisites](hello-hybrid-key-trust-prereqs.md)
|
||||
3. [New Installation Baseline](hello-hybrid-key-new-install.md)
|
||||
4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md)
|
||||
5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md)
|
||||
|
||||
@ -55,7 +55,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
|
||||
## Follow the Windows Hello for Business hybrid key trust deployment guide
|
||||
1. [Overview](hello-hybrid-cert-trust.md)
|
||||
2. [Prerequistes](hello-hybrid-key-trust-prereqs.md)
|
||||
2. [Prerequisites](hello-hybrid-key-trust-prereqs.md)
|
||||
3. [New Installation Baseline](hello-hybrid-key-new-install.md)
|
||||
4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md)
|
||||
5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md)
|
||||
|
||||
@ -168,7 +168,7 @@ Users must receive the Windows Hello for Business group policy settings and have
|
||||
|
||||
## Follow the Windows Hello for Business hybrid key trust deployment guide
|
||||
1. [Overview](hello-hybrid-cert-trust.md)
|
||||
2. [Prerequistes](hello-hybrid-key-trust-prereqs.md)
|
||||
2. [Prerequisites](hello-hybrid-key-trust-prereqs.md)
|
||||
3. [New Installation Baseline](hello-hybrid-key-new-install.md)
|
||||
4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md)
|
||||
5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md)
|
||||
|
||||
@ -45,7 +45,7 @@ For the most efficient deployment, configure these technologies in order beginni
|
||||
|
||||
## Follow the Windows Hello for Business hybrid key trust deployment guide
|
||||
1. [Overview](hello-hybrid-cert-trust.md)
|
||||
2. [Prerequistes](hello-hybrid-key-trust-prereqs.md)
|
||||
2. [Prerequisites](hello-hybrid-key-trust-prereqs.md)
|
||||
3. [New Installation Baseline](hello-hybrid-key-new-install.md)
|
||||
4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md)
|
||||
5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md)
|
||||
|
||||
@ -1,10 +1,10 @@
|
||||
# [Threat protection](index.md)
|
||||
|
||||
## [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md)
|
||||
## [Windows Defender Advanced Threat Protection](microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md)
|
||||
|
||||
### [Overview](windows-defender-atp/overview.md)
|
||||
#### [Attack surface reduction](windows-defender-atp/overview-attack-surface-reduction.md)
|
||||
##### [Hardware-based isolation](windows-defender-atp/overview-hardware-based-isolation.md)
|
||||
### [Overview](microsoft-defender-atp/overview.md)
|
||||
#### [Attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md)
|
||||
##### [Hardware-based isolation](microsoft-defender-atp/overview-hardware-based-isolation.md)
|
||||
###### [Application isolation](windows-defender-application-guard/wd-app-guard-overview.md)
|
||||
####### [System requirements](windows-defender-application-guard/reqs-wd-app-guard.md)
|
||||
###### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md)
|
||||
@ -15,104 +15,104 @@
|
||||
##### [Attack surface reduction](windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md)
|
||||
##### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md)
|
||||
#### [Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
|
||||
#### [Endpoint detection and response](windows-defender-atp/overview-endpoint-detection-response.md)
|
||||
##### [Security operations dashboard](windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
#### [Endpoint detection and response](microsoft-defender-atp/overview-endpoint-detection-response.md)
|
||||
##### [Security operations dashboard](microsoft-defender-atp/security-operations-dashboard.md)
|
||||
|
||||
##### [Incidents queue](windows-defender-atp/incidents-queue.md)
|
||||
###### [View and organize the Incidents queue](windows-defender-atp/view-incidents-queue.md)
|
||||
###### [Manage incidents](windows-defender-atp/manage-incidents-windows-defender-advanced-threat-protection.md)
|
||||
###### [Investigate incidents](windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md)
|
||||
##### [Incidents queue](microsoft-defender-atp/incidents-queue.md)
|
||||
###### [View and organize the Incidents queue](microsoft-defender-atp/view-incidents-queue.md)
|
||||
###### [Manage incidents](microsoft-defender-atp/manage-incidents.md)
|
||||
###### [Investigate incidents](microsoft-defender-atp/investigate-incidents.md)
|
||||
|
||||
|
||||
|
||||
##### Alerts queue
|
||||
###### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
###### [Investigate alerts](windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
###### [Investigate files](windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
###### [Investigate machines](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
###### [Investigate an IP address](windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
###### [Investigate a domain](windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
###### [Investigate a user account](windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
###### [View and organize the Alerts queue](microsoft-defender-atp/alerts-queue.md)
|
||||
###### [Manage alerts](microsoft-defender-atp/manage-alerts.md)
|
||||
###### [Investigate alerts](microsoft-defender-atp/investigate-alerts.md)
|
||||
###### [Investigate files](microsoft-defender-atp/investigate-files.md)
|
||||
###### [Investigate machines](microsoft-defender-atp/investigate-machines.md)
|
||||
###### [Investigate an IP address](microsoft-defender-atp/investigate-ip.md)
|
||||
###### [Investigate a domain](microsoft-defender-atp/investigate-domain.md)
|
||||
###### [Investigate a user account](microsoft-defender-atp/investigate-user.md)
|
||||
|
||||
##### Machines list
|
||||
###### [View and organize the Machines list](windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage machine group and tags](windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md)
|
||||
###### [Alerts related to this machine](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine)
|
||||
###### [Machine timeline](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline)
|
||||
####### [Search for specific events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events)
|
||||
####### [Filter events from a specific date](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date)
|
||||
####### [Export machine timeline events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events)
|
||||
####### [Navigate between pages](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages)
|
||||
###### [View and organize the Machines list](microsoft-defender-atp/machines-view-overview.md)
|
||||
###### [Manage machine group and tags](microsoft-defender-atp/machine-tags.md)
|
||||
###### [Alerts related to this machine](microsoft-defender-atp/investigate-machines.md#alerts-related-to-this-machine)
|
||||
###### [Machine timeline](microsoft-defender-atp/investigate-machines.md#machine-timeline)
|
||||
####### [Search for specific events](microsoft-defender-atp/investigate-machines.md#search-for-specific-events)
|
||||
####### [Filter events from a specific date](microsoft-defender-atp/investigate-machines.md#filter-events-from-a-specific-date)
|
||||
####### [Export machine timeline events](microsoft-defender-atp/investigate-machines.md#export-machine-timeline-events)
|
||||
####### [Navigate between pages](microsoft-defender-atp/investigate-machines.md#navigate-between-pages)
|
||||
|
||||
|
||||
##### [Take response actions](windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md)
|
||||
###### [Take response actions on a machine](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md)
|
||||
####### [Collect investigation package](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines)
|
||||
####### [Run antivirus scan](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines)
|
||||
####### [Restrict app execution](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution)
|
||||
####### [Remove app restriction](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction)
|
||||
####### [Isolate machines from the network](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network)
|
||||
####### [Release machine from isolation](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation)
|
||||
####### [Check activity details in Action center](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
|
||||
##### [Take response actions](microsoft-defender-atp/response-actions.md)
|
||||
###### [Take response actions on a machine](microsoft-defender-atp/respond-machine-alerts.md)
|
||||
####### [Collect investigation package](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-machines)
|
||||
####### [Run antivirus scan](microsoft-defender-atp/respond-machine-alerts.md#run-windows-defender-antivirus-scan-on-machines)
|
||||
####### [Restrict app execution](microsoft-defender-atp/respond-machine-alerts.md#restrict-app-execution)
|
||||
####### [Remove app restriction](microsoft-defender-atp/respond-machine-alerts.md#remove-app-restriction)
|
||||
####### [Isolate machines from the network](microsoft-defender-atp/respond-machine-alerts.md#isolate-machines-from-the-network)
|
||||
####### [Release machine from isolation](microsoft-defender-atp/respond-machine-alerts.md#release-machine-from-isolation)
|
||||
####### [Check activity details in Action center](microsoft-defender-atp/respond-machine-alerts.md#check-activity-details-in-action-center)
|
||||
|
||||
###### [Take response actions on a file](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md)
|
||||
####### [Stop and quarantine files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network)
|
||||
####### [Remove file from quarantine](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine)
|
||||
####### [Block files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network)
|
||||
####### [Remove file from blocked list](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list)
|
||||
####### [Check activity details in Action center](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
|
||||
####### [Deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis)
|
||||
####### [Submit files for analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis)
|
||||
####### [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports)
|
||||
####### [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis)
|
||||
###### [Take response actions on a file](microsoft-defender-atp/respond-file-alerts.md)
|
||||
####### [Stop and quarantine files in your network](microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network)
|
||||
####### [Remove file from quarantine](microsoft-defender-atp/respond-file-alerts.md#remove-file-from-quarantine)
|
||||
####### [Block files in your network](microsoft-defender-atp/respond-file-alerts.md#block-files-in-your-network)
|
||||
####### [Remove file from blocked list](microsoft-defender-atp/respond-file-alerts.md#remove-file-from-blocked-list)
|
||||
####### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center)
|
||||
####### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis)
|
||||
####### [Submit files for analysis](microsoft-defender-atp/respond-file-alerts.md#submit-files-for-analysis)
|
||||
####### [View deep analysis reports](microsoft-defender-atp/respond-file-alerts.md#view-deep-analysis-reports)
|
||||
####### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis)
|
||||
|
||||
|
||||
#### [Automated investigation and remediation](windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md)
|
||||
##### [Learn about the automated investigation and remediation dashboard](windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md)
|
||||
#### [Automated investigation and remediation](microsoft-defender-atp/automated-investigations.md)
|
||||
##### [Learn about the automated investigation and remediation dashboard](microsoft-defender-atp/manage-auto-investigation.md)
|
||||
|
||||
|
||||
#### [Secure score](windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
#### [Threat analytics](windows-defender-atp/threat-analytics.md)
|
||||
#### [Secure score](microsoft-defender-atp/overview-secure-score.md)
|
||||
#### [Threat analytics](microsoft-defender-atp/threat-analytics.md)
|
||||
|
||||
#### [Advanced hunting](windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md)
|
||||
##### [Query data using Advanced hunting](windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
###### [Advanced hunting reference](windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
|
||||
###### [Advanced hunting query language best practices](windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
|
||||
##### [Custom detections](windows-defender-atp/overview-custom-detections.md)
|
||||
###### [Create custom detections rules](windows-defender-atp/custom-detection-rules.md)
|
||||
#### [Advanced hunting](microsoft-defender-atp/overview-hunting.md)
|
||||
##### [Query data using Advanced hunting](microsoft-defender-atp/advanced-hunting.md)
|
||||
###### [Advanced hunting reference](microsoft-defender-atp/advanced-hunting-reference.md)
|
||||
###### [Advanced hunting query language best practices](microsoft-defender-atp/advanced-hunting-best-practices.md)
|
||||
##### [Custom detections](microsoft-defender-atp/overview-custom-detections.md)
|
||||
###### [Create custom detections rules](microsoft-defender-atp/custom-detection-rules.md)
|
||||
|
||||
|
||||
|
||||
#### [Management and APIs](windows-defender-atp/management-apis.md)
|
||||
##### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
|
||||
##### [Windows Defender ATP APIs](windows-defender-atp/apis-intro.md)
|
||||
##### [Managed security service provider support](windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md)
|
||||
#### [Management and APIs](microsoft-defender-atp/management-apis.md)
|
||||
##### [Understand threat intelligence concepts](microsoft-defender-atp/threat-indicator-concepts.md)
|
||||
##### [Windows Defender ATP APIs](microsoft-defender-atp/apis-intro.md)
|
||||
##### [Managed security service provider support](microsoft-defender-atp/mssp-support.md)
|
||||
|
||||
#### [Microsoft threat protection](windows-defender-atp/threat-protection-integration.md)
|
||||
##### [Protect users, data, and devices with conditional access](windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md)
|
||||
##### [Microsoft Cloud App Security integration overview](windows-defender-atp/microsoft-cloud-app-security-integration.md)
|
||||
##### [Information protection in Windows overview](windows-defender-atp/information-protection-in-windows-overview.md)
|
||||
#### [Microsoft threat protection](microsoft-defender-atp/threat-protection-integration.md)
|
||||
##### [Protect users, data, and devices with conditional access](microsoft-defender-atp/conditional-access.md)
|
||||
##### [Microsoft Cloud App Security integration overview](microsoft-defender-atp/microsoft-cloud-app-security-integration.md)
|
||||
##### [Information protection in Windows overview](microsoft-defender-atp/information-protection-in-windows-overview.md)
|
||||
|
||||
|
||||
|
||||
#### [Microsoft Threat Experts](windows-defender-atp/microsoft-threat-experts.md)
|
||||
#### [Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md)
|
||||
|
||||
|
||||
|
||||
#### [Portal overview](windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md)
|
||||
#### [Portal overview](microsoft-defender-atp/portal-overview.md)
|
||||
|
||||
|
||||
|
||||
### [Get started](windows-defender-atp/get-started.md)
|
||||
#### [What's new in Windows Defender ATP](windows-defender-atp/whats-new-in-windows-defender-atp.md)
|
||||
#### [Minimum requirements](windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md)
|
||||
#### [Validate licensing and complete setup](windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md)
|
||||
#### [Preview features](windows-defender-atp/preview-windows-defender-advanced-threat-protection.md)
|
||||
#### [Data storage and privacy](windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md)
|
||||
#### [Assign user access to the portal](windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md)
|
||||
### [Get started](microsoft-defender-atp/get-started.md)
|
||||
#### [What's new in Windows Defender ATP](microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md)
|
||||
#### [Minimum requirements](microsoft-defender-atp/minimum-requirements.md)
|
||||
#### [Validate licensing and complete setup](microsoft-defender-atp/licensing.md)
|
||||
#### [Preview features](microsoft-defender-atp/preview.md)
|
||||
#### [Data storage and privacy](microsoft-defender-atp/data-storage-privacy.md)
|
||||
#### [Assign user access to the portal](microsoft-defender-atp/assign-portal-access.md)
|
||||
|
||||
#### [Evaluate Windows Defender ATP](windows-defender-atp/evaluate-atp.md)
|
||||
#### [Evaluate Windows Defender ATP](microsoft-defender-atp/evaluate-atp.md)
|
||||
#####Evaluate attack surface reduction
|
||||
###### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md)
|
||||
###### [Application control](windows-defender-application-control/audit-windows-defender-application-control-policies.md)
|
||||
@ -123,10 +123,10 @@
|
||||
###### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md)
|
||||
##### [Evaluate next generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md)
|
||||
|
||||
#### [Access the Windows Defender Security Center Community Center](windows-defender-atp/community-windows-defender-advanced-threat-protection.md)
|
||||
#### [Access the Windows Defender Security Center Community Center](microsoft-defender-atp/community.md)
|
||||
|
||||
### [Configure and manage capabilities](windows-defender-atp/onboard.md)
|
||||
#### [Configure attack surface reduction](windows-defender-atp/configure-attack-surface-reduction.md)
|
||||
### [Configure and manage capabilities](microsoft-defender-atp/onboard.md)
|
||||
#### [Configure attack surface reduction](microsoft-defender-atp/configure-attack-surface-reduction.md)
|
||||
#####Hardware-based isolation
|
||||
###### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md)
|
||||
###### [Application isolation](windows-defender-application-guard/install-wd-app-guard.md)
|
||||
@ -213,208 +213,208 @@
|
||||
###### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md)
|
||||
|
||||
|
||||
#### [Configure Secure score dashboard security controls](windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure Secure score dashboard security controls](microsoft-defender-atp/secure-score-dashboard.md)
|
||||
|
||||
|
||||
#### Management and API support
|
||||
##### [Onboard machines](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard previous versions of Windows](windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard Windows 10 machines](windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
####### [Onboard machines using Group Policy](windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
####### [Onboard machines using System Center Configuration Manager](windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
####### [Onboard machines using Mobile Device Management tools](windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
######## [Onboard machines using Microsoft Intune](windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune)
|
||||
####### [Onboard machines using a local script](windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
####### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard servers](windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard non-Windows machines](windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard machines without Internet access](windows-defender-atp/onboard-offline-machines.md)
|
||||
###### [Run a detection test on a newly onboarded machine](windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
###### [Run simulated attacks on machines](windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md)
|
||||
###### [Configure proxy and Internet connectivity settings](windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
###### [Troubleshoot onboarding issues](windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
####### [Troubleshoot subscription and portal access issues](windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard machines](microsoft-defender-atp/onboard-configure.md)
|
||||
###### [Onboard previous versions of Windows](microsoft-defender-atp/onboard-downlevel.md)
|
||||
###### [Onboard Windows 10 machines](microsoft-defender-atp/configure-endpoints.md)
|
||||
####### [Onboard machines using Group Policy](microsoft-defender-atp/configure-endpoints-gp.md)
|
||||
####### [Onboard machines using System Center Configuration Manager](microsoft-defender-atp/configure-endpoints-sccm.md)
|
||||
####### [Onboard machines using Mobile Device Management tools](microsoft-defender-atp/configure-endpoints-mdm.md)
|
||||
######## [Onboard machines using Microsoft Intune](microsoft-defender-atp/configure-endpoints-mdm.md#onboard-machines-using-microsoft-intune)
|
||||
####### [Onboard machines using a local script](microsoft-defender-atp/configure-endpoints-script.md)
|
||||
####### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](microsoft-defender-atp/configure-endpoints-vdi.md)
|
||||
###### [Onboard servers](microsoft-defender-atp/configure-server-endpoints.md)
|
||||
###### [Onboard non-Windows machines](microsoft-defender-atp/configure-endpoints-non-windows.md)
|
||||
###### [Onboard machines without Internet access](microsoft-defender-atp/onboard-offline-machines.md)
|
||||
###### [Run a detection test on a newly onboarded machine](microsoft-defender-atp/run-detection-test.md)
|
||||
###### [Run simulated attacks on machines](microsoft-defender-atp/attack-simulations.md)
|
||||
###### [Configure proxy and Internet connectivity settings](microsoft-defender-atp/configure-proxy-internet.md)
|
||||
###### [Troubleshoot onboarding issues](microsoft-defender-atp/troubleshoot-onboarding.md)
|
||||
####### [Troubleshoot subscription and portal access issues](microsoft-defender-atp/troubleshoot-onboarding-error-messages.md)
|
||||
|
||||
##### [Windows Defender ATP API](windows-defender-atp/use-apis.md)
|
||||
###### [Get started with Windows Defender ATP APIs](windows-defender-atp/apis-intro.md)
|
||||
####### [Hello World](windows-defender-atp/api-hello-world.md)
|
||||
####### [Get access with application context](windows-defender-atp/exposed-apis-create-app-webapp.md)
|
||||
####### [Get access with user context](windows-defender-atp/exposed-apis-create-app-nativeapp.md)
|
||||
###### [APIs](windows-defender-atp/exposed-apis-list.md)
|
||||
##### [Windows Defender ATP API](microsoft-defender-atp/use-apis.md)
|
||||
###### [Get started with Windows Defender ATP APIs](microsoft-defender-atp/apis-intro.md)
|
||||
####### [Hello World](microsoft-defender-atp/api-hello-world.md)
|
||||
####### [Get access with application context](microsoft-defender-atp/exposed-apis-create-app-webapp.md)
|
||||
####### [Get access with user context](microsoft-defender-atp/exposed-apis-create-app-nativeapp.md)
|
||||
###### [APIs](microsoft-defender-atp/exposed-apis-list.md)
|
||||
|
||||
####### [Advanced Hunting](windows-defender-atp/run-advanced-query-api.md)
|
||||
####### [Advanced Hunting](microsoft-defender-atp/run-advanced-query-api.md)
|
||||
|
||||
####### [Alert](windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [List alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Create alert](windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Update Alert](windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get alert related domains information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get alert related IPs information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Alert](microsoft-defender-atp/alerts.md)
|
||||
######## [List alerts](microsoft-defender-atp/get-alerts.md)
|
||||
######## [Create alert](microsoft-defender-atp/create-alert-by-reference.md)
|
||||
######## [Update Alert](microsoft-defender-atp/update-alert.md)
|
||||
######## [Get alert information by ID](microsoft-defender-atp/get-alert-info-by-id.md)
|
||||
######## [Get alert related domains information](microsoft-defender-atp/get-alert-related-domain-info.md)
|
||||
######## [Get alert related file information](microsoft-defender-atp/get-alert-related-files-info.md)
|
||||
######## [Get alert related IPs information](microsoft-defender-atp/get-alert-related-ip-info.md)
|
||||
######## [Get alert related machine information](microsoft-defender-atp/get-alert-related-machine-info.md)
|
||||
######## [Get alert related user information](microsoft-defender-atp/get-alert-related-user-info.md)
|
||||
|
||||
####### [Machine](windows-defender-atp/machine-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [List machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Add or Remove machine tags](windows-defender-atp/add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Find machines by IP](windows-defender-atp/find-machines-by-ip-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Machine](microsoft-defender-atp/machine.md)
|
||||
######## [List machines](microsoft-defender-atp/get-machines.md)
|
||||
######## [Get machine by ID](microsoft-defender-atp/get-machine-by-id.md)
|
||||
######## [Get machine log on users](microsoft-defender-atp/get-machine-log-on-users.md)
|
||||
######## [Get machine related alerts](microsoft-defender-atp/get-machine-related-alerts.md)
|
||||
######## [Add or Remove machine tags](microsoft-defender-atp/add-or-remove-machine-tags.md)
|
||||
######## [Find machines by IP](microsoft-defender-atp/find-machines-by-ip.md)
|
||||
|
||||
####### [Machine Action](windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [List Machine Actions](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get Machine Action](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Collect investigation package](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get investigation package SAS URI](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Isolate machine](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Release machine from isolation](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Restrict app execution](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Remove app restriction](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Run antivirus scan](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Offboard machine](windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Stop and quarantine file](windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Initiate investigation (preview)](windows-defender-atp/initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Machine Action](microsoft-defender-atp/machineaction.md)
|
||||
######## [List Machine Actions](microsoft-defender-atp/get-machineactions-collection.md)
|
||||
######## [Get Machine Action](microsoft-defender-atp/get-machineaction-object.md)
|
||||
######## [Collect investigation package](microsoft-defender-atp/collect-investigation-package.md)
|
||||
######## [Get investigation package SAS URI](microsoft-defender-atp/get-package-sas-uri.md)
|
||||
######## [Isolate machine](microsoft-defender-atp/isolate-machine.md)
|
||||
######## [Release machine from isolation](microsoft-defender-atp/unisolate-machine.md)
|
||||
######## [Restrict app execution](microsoft-defender-atp/restrict-code-execution.md)
|
||||
######## [Remove app restriction](microsoft-defender-atp/unrestrict-code-execution.md)
|
||||
######## [Run antivirus scan](microsoft-defender-atp/run-av-scan.md)
|
||||
######## [Offboard machine](microsoft-defender-atp/offboard-machine-api.md)
|
||||
######## [Stop and quarantine file](microsoft-defender-atp/stop-and-quarantine-file.md)
|
||||
######## [Initiate investigation (preview)](microsoft-defender-atp/initiate-autoir-investigation.md)
|
||||
|
||||
####### [Indicators](windows-defender-atp/ti-indicator-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Submit Indicator](windows-defender-atp/post-ti-indicator-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [List Indicators](windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Delete Indicator](windows-defender-atp/delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Indicators](microsoft-defender-atp/ti-indicator.md)
|
||||
######## [Submit Indicator](microsoft-defender-atp/post-ti-indicator.md)
|
||||
######## [List Indicators](microsoft-defender-atp/get-ti-indicators-collection.md)
|
||||
######## [Delete Indicator](microsoft-defender-atp/delete-ti-indicator-by-id.md)
|
||||
|
||||
####### Domain
|
||||
######## [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get domain related alerts](microsoft-defender-atp/get-domain-related-alerts.md)
|
||||
######## [Get domain related machines](microsoft-defender-atp/get-domain-related-machines.md)
|
||||
######## [Get domain statistics](microsoft-defender-atp/get-domain-statistics.md)
|
||||
######## [Is domain seen in organization](microsoft-defender-atp/is-domain-seen-in-org.md)
|
||||
|
||||
####### [File](windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [File](microsoft-defender-atp/files.md)
|
||||
######## [Get file information](microsoft-defender-atp/get-file-information.md)
|
||||
######## [Get file related alerts](microsoft-defender-atp/get-file-related-alerts.md)
|
||||
######## [Get file related machines](microsoft-defender-atp/get-file-related-machines.md)
|
||||
######## [Get file statistics](microsoft-defender-atp/get-file-statistics.md)
|
||||
|
||||
####### IP
|
||||
######## [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get IP related alerts](microsoft-defender-atp/get-ip-related-alerts.md)
|
||||
######## [Get IP related machines](microsoft-defender-atp/get-ip-related-machines.md)
|
||||
######## [Get IP statistics](microsoft-defender-atp/get-ip-statistics.md)
|
||||
######## [Is IP seen in organization](microsoft-defender-atp/is-ip-seen-org.md)
|
||||
|
||||
####### [User](windows-defender-atp/user-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
######## [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [User](microsoft-defender-atp/user.md)
|
||||
######## [Get user related alerts](microsoft-defender-atp/get-user-related-alerts.md)
|
||||
######## [Get user related machines](microsoft-defender-atp/get-user-related-machines.md)
|
||||
|
||||
|
||||
###### How to use APIs - Samples
|
||||
####### Advanced Hunting API
|
||||
######## [Schedule advanced Hunting using Microsoft Flow](windows-defender-atp/run-advanced-query-sample-ms-flow.md)
|
||||
######## [Advanced Hunting using PowerShell](windows-defender-atp/run-advanced-query-sample-powershell.md)
|
||||
######## [Advanced Hunting using Python](windows-defender-atp/run-advanced-query-sample-python.md)
|
||||
######## [Create custom Power BI reports](windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md)
|
||||
######## [Schedule advanced Hunting using Microsoft Flow](microsoft-defender-atp/run-advanced-query-sample-ms-flow.md)
|
||||
######## [Advanced Hunting using PowerShell](microsoft-defender-atp/run-advanced-query-sample-powershell.md)
|
||||
######## [Advanced Hunting using Python](microsoft-defender-atp/run-advanced-query-sample-python.md)
|
||||
######## [Create custom Power BI reports](microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token.md)
|
||||
####### Multiple APIs
|
||||
######## [PowerShell](windows-defender-atp/exposed-apis-full-sample-powershell.md)
|
||||
####### [Using OData Queries](windows-defender-atp/exposed-apis-odata-samples.md)
|
||||
######## [PowerShell](microsoft-defender-atp/exposed-apis-full-sample-powershell.md)
|
||||
####### [Using OData Queries](microsoft-defender-atp/exposed-apis-odata-samples.md)
|
||||
|
||||
|
||||
#####Windows updates (KB) info
|
||||
###### [Get KbInfo collection](windows-defender-atp/get-kbinfo-collection-windows-defender-advanced-threat-protection.md)
|
||||
###### [Get KbInfo collection](microsoft-defender-atp/get-kbinfo-collection.md)
|
||||
#####Common Vulnerabilities and Exposures (CVE) to KB map
|
||||
###### [Get CVE-KB map](windows-defender-atp/get-cvekbmap-collection-windows-defender-advanced-threat-protection.md)
|
||||
###### [Get CVE-KB map](microsoft-defender-atp/get-cvekbmap-collection.md)
|
||||
|
||||
|
||||
##### API for custom alerts (Deprecated)
|
||||
###### [Enable the custom threat intelligence application (Deprecated)](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
###### [Use the threat intelligence API to create custom alerts (Deprecated)](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
###### [Create custom threat intelligence alerts (Deprecated)](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md)
|
||||
###### [PowerShell code examples (Deprecated)](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md)
|
||||
###### [Python code examples (Deprecated)](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md)
|
||||
###### [Experiment with custom threat intelligence alerts (Deprecated)](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
###### [Troubleshoot custom threat intelligence issues (Deprecated)](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
###### [Enable the custom threat intelligence application (Deprecated)](microsoft-defender-atp/enable-custom-ti.md)
|
||||
###### [Use the threat intelligence API to create custom alerts (Deprecated)](microsoft-defender-atp/use-custom-ti.md)
|
||||
###### [Create custom threat intelligence alerts (Deprecated)](microsoft-defender-atp/custom-ti-api.md)
|
||||
###### [PowerShell code examples (Deprecated)](microsoft-defender-atp/powershell-example-code.md)
|
||||
###### [Python code examples (Deprecated)](microsoft-defender-atp/python-example-code.md)
|
||||
###### [Experiment with custom threat intelligence alerts (Deprecated)](microsoft-defender-atp/experiment-custom-ti.md)
|
||||
###### [Troubleshoot custom threat intelligence issues (Deprecated)](microsoft-defender-atp/troubleshoot-custom-ti.md)
|
||||
|
||||
|
||||
##### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md)
|
||||
###### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
###### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
###### [Configure HP ArcSight to pull alerts](windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
###### [Windows Defender ATP SIEM alert API fields](windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md)
|
||||
###### [Pull alerts using SIEM REST API](windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
###### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md)
|
||||
##### [Pull alerts to your SIEM tools](microsoft-defender-atp/configure-siem.md)
|
||||
###### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md)
|
||||
###### [Configure Splunk to pull alerts](microsoft-defender-atp/configure-splunk.md)
|
||||
###### [Configure HP ArcSight to pull alerts](microsoft-defender-atp/configure-arcsight.md)
|
||||
###### [Windows Defender ATP SIEM alert API fields](microsoft-defender-atp/api-portal-mapping.md)
|
||||
###### [Pull alerts using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md)
|
||||
###### [Troubleshoot SIEM tool integration issues](microsoft-defender-atp/troubleshoot-siem.md)
|
||||
|
||||
|
||||
##### Reporting
|
||||
###### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
###### [Threat protection reports](windows-defender-atp/threat-protection-reports-windows-defender-advanced-threat-protection.md)
|
||||
###### [Machine health and compliance reports](windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md)
|
||||
###### [Create and build Power BI reports using Windows Defender ATP data](microsoft-defender-atp/powerbi-reports.md)
|
||||
###### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md)
|
||||
###### [Machine health and compliance reports](microsoft-defender-atp/machine-reports.md)
|
||||
|
||||
##### Interoperability
|
||||
###### [Partner applications](windows-defender-atp/partner-applications.md)
|
||||
###### [Partner applications](microsoft-defender-atp/partner-applications.md)
|
||||
|
||||
|
||||
##### Role-based access control
|
||||
###### [Manage portal access using RBAC](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md)
|
||||
####### [Create and manage roles](windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md)
|
||||
####### [Create and manage machine groups](windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md)
|
||||
######## [Create and manage machine tags](windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md)
|
||||
####### [Create and manage roles](microsoft-defender-atp/user-roles.md)
|
||||
####### [Create and manage machine groups](microsoft-defender-atp/machine-groups.md)
|
||||
######## [Create and manage machine tags](microsoft-defender-atp/machine-tags.md)
|
||||
|
||||
|
||||
##### [Configure managed security service provider (MSSP) support](windows-defender-atp/configure-mssp-support-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure managed security service provider (MSSP) support](microsoft-defender-atp/configure-mssp-support.md)
|
||||
|
||||
|
||||
#### [Configure and manage Microsoft Threat Experts capabilities](windows-defender-atp/configure-microsoft-threat-experts.md)
|
||||
#### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md)
|
||||
|
||||
|
||||
|
||||
#### Configure Microsoft threat protection integration
|
||||
##### [Configure conditional access](windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure Microsoft Cloud App Security integration](windows-defender-atp/microsoft-cloud-app-security-config.md)
|
||||
##### [Configure information protection in Windows](windows-defender-atp/information-protection-in-windows-config.md)
|
||||
##### [Configure conditional access](microsoft-defender-atp/configure-conditional-access.md)
|
||||
##### [Configure Microsoft Cloud App Security integration](microsoft-defender-atp/microsoft-cloud-app-security-config.md)
|
||||
##### [Configure information protection in Windows](microsoft-defender-atp/information-protection-in-windows-config.md)
|
||||
|
||||
|
||||
|
||||
|
||||
#### [Configure Windows Defender Security Center settings](windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure Windows Defender Security Center settings](microsoft-defender-atp/preferences-setup.md)
|
||||
##### General
|
||||
###### [Update data retention settings](windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
###### [Configure alert notifications](windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
###### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
###### [Enable Secure score security controls](windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
###### [Configure advanced features](windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md)
|
||||
###### [Update data retention settings](microsoft-defender-atp/data-retention-settings.md)
|
||||
###### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md)
|
||||
###### [Enable and create Power BI reports using Windows Defender Security center data](microsoft-defender-atp/powerbi-reports.md)
|
||||
###### [Enable Secure score security controls](microsoft-defender-atp/enable-secure-score.md)
|
||||
###### [Configure advanced features](microsoft-defender-atp/advanced-features.md)
|
||||
|
||||
##### Permissions
|
||||
###### [Use basic permissions to access the portal](windows-defender-atp/basic-permissions-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage portal access using RBAC](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md)
|
||||
####### [Create and manage roles](windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md)
|
||||
####### [Create and manage machine groups](windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md)
|
||||
######## [Create and manage machine tags](windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md)
|
||||
###### [Use basic permissions to access the portal](microsoft-defender-atp/basic-permissions.md)
|
||||
###### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md)
|
||||
####### [Create and manage roles](microsoft-defender-atp/user-roles.md)
|
||||
####### [Create and manage machine groups](microsoft-defender-atp/machine-groups.md)
|
||||
######## [Create and manage machine tags](microsoft-defender-atp/machine-tags.md)
|
||||
|
||||
##### APIs
|
||||
###### [Enable Threat intel (Deprecated)](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
###### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
###### [Enable Threat intel (Deprecated)](microsoft-defender-atp/enable-custom-ti.md)
|
||||
###### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md)
|
||||
|
||||
#####Rules
|
||||
###### [Manage suppression rules](windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage automation allowed/blocked lists](windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage indicators](windows-defender-atp/manage-indicators.md)
|
||||
###### [Manage automation file uploads](windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage automation folder exclusions](windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md)
|
||||
###### [Manage automation allowed/blocked lists](microsoft-defender-atp/manage-automation-allowed-blocked-list.md)
|
||||
###### [Manage indicators](microsoft-defender-atp/manage-indicators.md)
|
||||
###### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md)
|
||||
###### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md)
|
||||
|
||||
#####Machine management
|
||||
###### [Onboarding machines](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
###### [Offboarding machines](windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboarding machines](microsoft-defender-atp/onboard-configure.md)
|
||||
###### [Offboarding machines](microsoft-defender-atp/offboard-machines.md)
|
||||
|
||||
##### [Configure Windows Defender Security Center time zone settings](windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure Windows Defender Security Center time zone settings](microsoft-defender-atp/time-settings.md)
|
||||
|
||||
|
||||
### [Troubleshoot Windows Defender ATP](windows-defender-atp/troubleshoot-wdatp.md)
|
||||
### [Troubleshoot Windows Defender ATP](microsoft-defender-atp/troubleshoot-overview.md)
|
||||
####Troubleshoot sensor state
|
||||
##### [Check sensor state](windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md)
|
||||
##### [Fix unhealthy sensors](windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
##### [Inactive machines](windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines)
|
||||
##### [Misconfigured machines](windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines)
|
||||
##### [Review sensor events and errors on machines with Event Viewer](windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md)
|
||||
##### [Check sensor state](microsoft-defender-atp/check-sensor-status.md)
|
||||
##### [Fix unhealthy sensors](microsoft-defender-atp/fix-unhealthy-sensors.md)
|
||||
##### [Inactive machines](microsoft-defender-atp/fix-unhealthy-sensors.md#inactive-machines)
|
||||
##### [Misconfigured machines](microsoft-defender-atp/fix-unhealthy-sensors.md#misconfigured-machines)
|
||||
##### [Review sensor events and errors on machines with Event Viewer](microsoft-defender-atp/event-error-codes.md)
|
||||
|
||||
#### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
##### [Check service health](windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md)
|
||||
#### [Troubleshoot Windows Defender ATP service issues](microsoft-defender-atp/troubleshoot-mdatp.md)
|
||||
##### [Check service health](microsoft-defender-atp/service-status.md)
|
||||
|
||||
####Troubleshoot attack surface reduction
|
||||
##### [Network protection](windows-defender-exploit-guard/troubleshoot-np.md)
|
||||
|
||||
@ -63,6 +63,8 @@ Detailed Tracking security policy settings and audit events can be used to monit
|
||||
- [Audit Process Termination](audit-process-termination.md)
|
||||
- [Audit RPC Events](audit-rpc-events.md)
|
||||
|
||||
> **Note:** For more information, see [Security Monitoring](https://blogs.technet.microsoft.com/nathangau/2018/01/25/security-monitoring-a-possible-new-way-to-detect-privilege-escalation/)
|
||||
|
||||
## DS Access
|
||||
|
||||
DS Access security audit policy settings provide a detailed audit trail of attempts to access and modify objects in Active Directory Domain Services (AD DS). These audit events are logged only on domain controllers. This category includes the following subcategories:
|
||||
@ -90,7 +92,7 @@ Logon/Logoff security policy settings and audit events allow you to track attemp
|
||||
|
||||
## Object Access
|
||||
|
||||
Object Access policy settings and audit events allow you to track attempts to access specific objects or types of objects on a network or computer. To audit attempts to access a file, directory, registry key, or any other object, you must enable the appropriate object Aaccess auditing subcategory for success and/or failure events. For example, the file system subcategory needs to be enabled to audit file operations, and the Registry subcategory needs to be enabled to audit registry accesses.
|
||||
Object Access policy settings and audit events allow you to track attempts to access specific objects or types of objects on a network or computer. To audit attempts to access a file, directory, registry key, or any other object, you must enable the appropriate Object Access auditing subcategory for success and/or failure events. For example, the file system subcategory needs to be enabled to audit file operations, and the Registry subcategory needs to be enabled to audit registry accesses.
|
||||
|
||||
Proving that these audit policies are in effect to an external auditor is more difficult. There is no easy way to verify that the proper SACLs are set on all inherited objects. To address this issue, see [Global Object Access Auditing](#global-object-access-auditing).
|
||||
|
||||
|
||||
@ -10,16 +10,15 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 08/11/2018
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
# Change history for threat protection
|
||||
This topic lists new and updated topics in the [Windows Defender ATP](windows-defender-atp/windows-defender-advanced-threat-protection.md) documentation.
|
||||
This topic lists new and updated topics in the [Microsoft Defender ATP](microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) documentation.
|
||||
|
||||
## August 2018
|
||||
|
||||
New or changed topic | Description
|
||||
---------------------|------------
|
||||
[Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) | Reorganized Windows 10 security topics to reflect the Windows Defender ATP platform.
|
||||
[Microsoft Defender Advanced Threat Protection](microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) | Reorganized Windows 10 security topics to reflect the Windows Defender ATP platform.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ Using configurable code integrity to restrict devices to only authorized apps ha
|
||||
|
||||
1. Configurable code integrity policy is enforced by the Windows kernel itself. As such, the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.
|
||||
2. Configurable code integrity allows customers to set application control policy not only over code running in user mode, but also kernel mode hardware and software drivers and even code that runs as part of Windows.
|
||||
3. Customers can protect the configurable code integrity policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it extremely difficult for an attacker with administrative privledge, or malicious software that managed to gain administrative privilege, to alter the application control policy.
|
||||
3. Customers can protect the configurable code integrity policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it extremely difficult for an attacker with administrative privilege, or malicious software that managed to gain administrative privilege, to alter the application control policy.
|
||||
4. The entire configurable code integrity enforcement mechanism can be protected by HVCI, where even if a vulnerability exists in kernel mode code, the likelihood that an attacker could successfully exploit it is significantly diminished. Why is this relevant? That’s because an attacker that compromises the kernel would otherwise have enough privilege to disable most system defenses and override the application control policies enforced by configurable code integrity or any other application control solution.
|
||||
|
||||
## (Re-)Introducing Windows Defender Application Control
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Threat Protection (Windows 10)
|
||||
description: Learn how Windows Defender ATP helps protect against threats.
|
||||
keywords: threat protection, windows defender advanced threat protection, attack surface reduction, next generation protection, endpoint detection and response, automated investigation and response, microsoft threat experts, secure score, advanced hunting
|
||||
description: Learn how Microsoft Defender ATP helps protect against threats.
|
||||
keywords: threat protection, Microsoft Defender Advanced Threat Protection, attack surface reduction, next generation protection, endpoint detection and response, automated investigation and response, microsoft threat experts, secure score, advanced hunting
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -12,12 +12,9 @@ ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
# Threat Protection
|
||||
[Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Windows Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture.
|
||||
[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Microsoft Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture.
|
||||
|
||||
>[!Note]
|
||||
> The Windows Defender Security Center is currently going through rebranding. All references to Windows Defender will be replaced with Microsoft Defender. You will see the updates in the user interface and in the documentation library in next few months.
|
||||
|
||||
<center><h2>Windows Defender ATP</center></h2>
|
||||
<center><h2>Microsoft Defender ATP</center></h2>
|
||||
<table>
|
||||
<tr>
|
||||
<td><a href="#tvm"><center><img src="images/TVM_icon.png"> <br><b>Threat & Vulnerability Management</b></center></a></td>
|
||||
@ -40,19 +37,19 @@ ms.localizationpriority: medium
|
||||
|
||||
<a name="tvm"></a>
|
||||
|
||||
**[Threat & Vulnerability Management](windows-defender-atp/next-gen-threat-and-vuln-mgt.md)**<br>
|
||||
**[Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)**<br>
|
||||
This built-in capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.
|
||||
- [Risk-based Threat & Vulnerability Management](windows-defender-atp/next-gen-threat-and-vuln-mgt.md)
|
||||
- [What's in the dashboard and what it means for my organization](windows-defender-atp/tvm-dashboard-insights.md)
|
||||
- [Configuration score](windows-defender-atp/configuration-score.md)
|
||||
- [Scenarios](windows-defender-atp/threat-and-vuln-mgt-scenarios.md)
|
||||
- [Risk-based Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
|
||||
- [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md)
|
||||
- [Configuration score](microsoft-defender-atp/configuration-score.md)
|
||||
- [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md)
|
||||
|
||||
<a name="asr"></a>
|
||||
|
||||
**[Attack surface reduction](windows-defender-atp/overview-attack-surface-reduction.md)**<br>
|
||||
**[Attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md)**<br>
|
||||
The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations.
|
||||
|
||||
- [Hardware based isolation](windows-defender-atp/overview-hardware-based-isolation.md)
|
||||
- [Hardware based isolation](microsoft-defender-atp/overview-hardware-based-isolation.md)
|
||||
- [Application control](windows-defender-application-control/windows-defender-application-control.md)
|
||||
- [Device control](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
|
||||
- [Exploit protection](windows-defender-exploit-guard/exploit-protection-exploit-guard.md)
|
||||
@ -64,7 +61,7 @@ The attack surface reduction set of capabilities provide the first line of defen
|
||||
<a name="ngp"></a>
|
||||
|
||||
**[Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)**<br>
|
||||
To further reinforce the security perimeter of your network, Windows Defender ATP uses next generation protection designed to catch all types of emerging threats.
|
||||
To further reinforce the security perimeter of your network, Microsoft Defender ATP uses next generation protection designed to catch all types of emerging threats.
|
||||
|
||||
- [Behavior monitoring](/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus)
|
||||
- [Cloud-based protection](/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus)
|
||||
@ -74,67 +71,67 @@ To further reinforce the security perimeter of your network, Windows Defender AT
|
||||
|
||||
<a name="edr"></a>
|
||||
|
||||
**[Endpoint detection and response](windows-defender-atp/overview-endpoint-detection-response.md)**<br>
|
||||
**[Endpoint detection and response](microsoft-defender-atp/overview-endpoint-detection-response.md)**<br>
|
||||
Endpoint detection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars.
|
||||
|
||||
- [Alerts](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
- [Historical endpoint data](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline)
|
||||
- [Response orchestration](windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md)
|
||||
- [Forensic collection](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines)
|
||||
- [Threat intelligence](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
|
||||
- [Advanced detonation and analysis service](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis)
|
||||
- [Advanced hunting](windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md)
|
||||
- [Custom detection](windows-defender-atp/overview-custom-detections.md)
|
||||
- [Realtime and historical hunting](windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
- [Alerts](microsoft-defender-atp/alerts-queue.md)
|
||||
- [Historical endpoint data](microsoft-defender-atp/investigate-machines.md#machine-timeline)
|
||||
- [Response orchestration](microsoft-defender-atp/response-actions.md)
|
||||
- [Forensic collection](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-machines)
|
||||
- [Threat intelligence](microsoft-defender-atp/threat-indicator-concepts.md)
|
||||
- [Advanced detonation and analysis service](microsoft-defender-atp/respond-file-alerts.md#deep-analysis)
|
||||
- [Advanced hunting](microsoft-defender-atp/overview-hunting.md)
|
||||
- [Custom detection](microsoft-defender-atp/overview-custom-detections.md)
|
||||
- [Realtime and historical hunting](microsoft-defender-atp/advanced-hunting.md)
|
||||
|
||||
<a name="ai"></a>
|
||||
|
||||
**[Automated investigation and remediation](windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md)**<br>
|
||||
In conjunction with being able to quickly respond to advanced attacks, Windows Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
|
||||
**[Automated investigation and remediation](microsoft-defender-atp/automated-investigations.md)**<br>
|
||||
In conjunction with being able to quickly respond to advanced attacks, Microsoft Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
|
||||
|
||||
- [Automated investigation and remediation](windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md)
|
||||
- [Threat remediation](windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md#how-threats-are-remediated)
|
||||
- [Manage automated investigations](windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md)
|
||||
- [Analyze automated investigation](windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md#analyze-automated-investigations)
|
||||
- [Automated investigation and remediation](microsoft-defender-atp/automated-investigations.md)
|
||||
- [Threat remediation](microsoft-defender-atp/automated-investigations.md#how-threats-are-remediated)
|
||||
- [Manage automated investigations](microsoft-defender-atp/manage-auto-investigation.md)
|
||||
- [Analyze automated investigation](microsoft-defender-atp/manage-auto-investigation.md#analyze-automated-investigations)
|
||||
|
||||
<a name="ss"></a>
|
||||
|
||||
**[Secure score](windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md)**<br>
|
||||
Windows Defender ATP includes a secure score to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security of your organization.
|
||||
- [Asset inventory](windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
- [Recommended improvement actions](windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
- [Secure score](windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
- [Threat analytics](windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
**[Secure score](microsoft-defender-atp/overview-secure-score.md)**<br>
|
||||
Microsoft Defender ATP includes a secure score to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security of your organization.
|
||||
- [Asset inventory](microsoft-defender-atp/secure-score-dashboard.md)
|
||||
- [Recommended improvement actions](microsoft-defender-atp/secure-score-dashboard.md)
|
||||
- [Secure score](microsoft-defender-atp/overview-secure-score.md)
|
||||
- [Threat analytics](microsoft-defender-atp/threat-analytics.md)
|
||||
|
||||
<a name="mte"></a>
|
||||
|
||||
**[Microsoft Threat Experts](windows-defender-atp/microsoft-threat-experts.md)**<br>
|
||||
Windows Defender ATP's new managed threat hunting service provides proactive hunting, prioritization and additional context and insights that further empower Security Operation Centers (SOCs) to identify and respond to threats quickly and accurately.
|
||||
**[Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md)**<br>
|
||||
Microsoft Defender ATP's new managed threat hunting service provides proactive hunting, prioritization and additional context and insights that further empower Security Operation Centers (SOCs) to identify and respond to threats quickly and accurately.
|
||||
|
||||
- [Targeted attack notification](windows-defender-atp/microsoft-threat-experts.md)
|
||||
- [Experts-on-demand](windows-defender-atp/microsoft-threat-experts.md)
|
||||
- [Configure your Microsoft Threat Experts managed hunting service](windows-defender-atp/configure-microsoft-threat-experts.md)
|
||||
- [Targeted attack notification](microsoft-defender-atp/microsoft-threat-experts.md)
|
||||
- [Experts-on-demand](microsoft-defender-atp/microsoft-threat-experts.md)
|
||||
- [Configure your Microsoft Threat Protection managed hunting service](microsoft-defender-atp/configure-microsoft-threat-experts.md)
|
||||
|
||||
<a name="apis"></a>
|
||||
|
||||
**[Management and APIs](windows-defender-atp/management-apis.md)**<br>
|
||||
Integrate Windows Defender Advanced Threat Protection into your existing workflows.
|
||||
- [Onboarding](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
- [API and SIEM integration](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md)
|
||||
- [Exposed APIs](windows-defender-atp/use-apis.md)
|
||||
- [Role-based access control (RBAC)](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md)
|
||||
- [Reporting and trends](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
**[Management and APIs](microsoft-defender-atp/management-apis.md)**<br>
|
||||
Integrate Microsoft Defender Advanced Threat Protection into your existing workflows.
|
||||
- [Onboarding](microsoft-defender-atp/onboard-configure.md)
|
||||
- [API and SIEM integration](microsoft-defender-atp/configure-siem.md)
|
||||
- [Exposed APIs](microsoft-defender-atp/use-apis.md)
|
||||
- [Role-based access control (RBAC)](microsoft-defender-atp/rbac.md)
|
||||
- [Reporting and trends](microsoft-defender-atp/powerbi-reports.md)
|
||||
|
||||
<a name="mtp"></a>
|
||||
|
||||
**[Microsoft Threat Protection](windows-defender-atp/threat-protection-integration.md)** <br>
|
||||
Windows Defender ATP is part of the Microsoft Threat Protection solution that helps implement end-to-end security across possible attack surfaces in the modern workplace. Bring the power of Microsoft threat protection to your organization.
|
||||
- [Conditional access](windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md)
|
||||
- [O365 ATP](windows-defender-atp/threat-protection-integration.md)
|
||||
- [Azure ATP](windows-defender-atp/threat-protection-integration.md)
|
||||
- [Azure Security Center](windows-defender-atp/threat-protection-integration.md)
|
||||
- [Skype for Business](windows-defender-atp/threat-protection-integration.md)
|
||||
- [Microsoft Cloud App Security](windows-defender-atp/microsoft-cloud-app-security-integration.md)
|
||||
**[Microsoft Threat Protection](microsoft-defender-atp/threat-protection-integration.md)** <br>
|
||||
Microsoft Defender ATP is part of the Microsoft Threat Protection solution that helps implement end-to-end security across possible attack surfaces in the modern workplace. Bring the power of Microsoft threat protection to your organization.
|
||||
- [Conditional access](microsoft-defender-atp/conditional-access.md)
|
||||
- [O365 ATP](microsoft-defender-atp/threat-protection-integration.md)
|
||||
- [Azure ATP](microsoft-defender-atp/threat-protection-integration.md)
|
||||
- [Azure Security Center](microsoft-defender-atp/threat-protection-integration.md)
|
||||
- [Skype for Business](microsoft-defender-atp/threat-protection-integration.md)
|
||||
- [Microsoft Cloud App Security](microsoft-defender-atp/microsoft-cloud-app-security-integration.md)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -22,6 +22,8 @@ Microsoft Safety Scanner is a scan tool designed to find and remove malware from
|
||||
|
||||
- [Download Microsoft Safety Scanner (64-bit)](https://go.microsoft.com/fwlink/?LinkId=212732)
|
||||
|
||||
> **NOTE** The security intelligence update version of the Microsoft Safety Scaner matches the version described [in this web page](https://www.microsoft.com/en-us/wdsi/definitions).
|
||||
|
||||
Safety Scanner only scans when manually triggered and is available for use 10 days after being downloaded. We recommend that you always download the latest version of this tool before each scan.
|
||||
|
||||
> **NOTE:** This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Windows Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/en-us/windows/windows-defender) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/en-us/wdsi/help/troubleshooting-infection).
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
# [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md)
|
||||
# [Microsoft Defender Advanced Threat Protection](microsoft-defender-advanced-threat-protection.md)
|
||||
|
||||
## [Overview](overview.md)
|
||||
### [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
@ -20,97 +20,102 @@
|
||||
#### [Network firewall](../windows-firewall/windows-firewall-with-advanced-security.md)
|
||||
### [Next generation protection](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
|
||||
### [Endpoint detection and response](overview-endpoint-detection-response.md)
|
||||
#### [Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
#### [Security operations dashboard](security-operations-dashboard.md)
|
||||
|
||||
|
||||
#### [Incidents queue](incidents-queue.md)
|
||||
##### [View and organize the Incidents queue](view-incidents-queue.md)
|
||||
##### [Manage incidents](manage-incidents-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate incidents](investigate-incidents-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage incidents](manage-incidents.md)
|
||||
##### [Investigate incidents](investigate-incidents.md)
|
||||
|
||||
|
||||
#### Alerts queue
|
||||
##### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
##### [View and organize the Alerts queue](alerts-queue.md)
|
||||
##### [Manage alerts](manage-alerts.md)
|
||||
##### [Investigate alerts](investigate-alerts.md)
|
||||
##### [Investigate files](investigate-files.md)
|
||||
##### [Investigate machines](investigate-machines.md)
|
||||
##### [Investigate an IP address](investigate-ip.md)
|
||||
##### [Investigate a domain](investigate-domain.md)
|
||||
##### [Investigate a user account](investigate-user.md)
|
||||
|
||||
#### Machines list
|
||||
##### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage machine group and tags](machine-tags-windows-defender-advanced-threat-protection.md)
|
||||
##### [Alerts related to this machine](investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine)
|
||||
##### [Machine timeline](investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline)
|
||||
###### [Search for specific events](investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events)
|
||||
###### [Filter events from a specific date](investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date)
|
||||
###### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events)
|
||||
###### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages)
|
||||
##### [View and organize the Machines list](machines-view-overview.md)
|
||||
##### [Manage machine group and tags](machine-tags.md)
|
||||
##### [Alerts related to this machine](investigate-machines.md#alerts-related-to-this-machine)
|
||||
##### [Machine timeline](investigate-machines.md#machine-timeline)
|
||||
###### [Search for specific events](investigate-machines.md#search-for-specific-events)
|
||||
###### [Filter events from a specific date](investigate-machines.md#filter-events-from-a-specific-date)
|
||||
###### [Export machine timeline events](investigate-machines.md#export-machine-timeline-events)
|
||||
###### [Navigate between pages](investigate-machines.md#navigate-between-pages)
|
||||
|
||||
|
||||
#### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md)
|
||||
##### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md)
|
||||
###### [Collect investigation package](respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines)
|
||||
###### [Run antivirus scan](respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines)
|
||||
###### [Restrict app execution](respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution)
|
||||
###### [Remove app restriction](respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction)
|
||||
###### [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network)
|
||||
###### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation)
|
||||
###### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
|
||||
#### [Take response actions](response-actions.md)
|
||||
##### [Take response actions on a machine](respond-machine-alerts.md)
|
||||
###### [Collect investigation package](respond-machine-alerts.md#collect-investigation-package-from-machines)
|
||||
###### [Run antivirus scan](respond-machine-alerts.md#run-windows-defender-antivirus-scan-on-machines)
|
||||
###### [Restrict app execution](respond-machine-alerts.md#restrict-app-execution)
|
||||
###### [Remove app restriction](respond-machine-alerts.md#remove-app-restriction)
|
||||
###### [Isolate machines from the network](respond-machine-alerts.md#isolate-machines-from-the-network)
|
||||
###### [Release machine from isolation](respond-machine-alerts.md#release-machine-from-isolation)
|
||||
###### [Check activity details in Action center](respond-machine-alerts.md#check-activity-details-in-action-center)
|
||||
|
||||
##### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md)
|
||||
###### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network)
|
||||
###### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine)
|
||||
###### [Block files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network)
|
||||
###### [Remove file from blocked list](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list)
|
||||
###### [Check activity details in Action center](respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
|
||||
###### [Deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis)
|
||||
###### [Submit files for analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis)
|
||||
###### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports)
|
||||
###### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis)
|
||||
##### [Take response actions on a file](respond-file-alerts.md)
|
||||
###### [Stop and quarantine files in your network](respond-file-alerts.md#stop-and-quarantine-files-in-your-network)
|
||||
###### [Remove file from quarantine](respond-file-alerts.md#remove-file-from-quarantine)
|
||||
###### [Block files in your network](respond-file-alerts.md#block-files-in-your-network)
|
||||
###### [Remove file from blocked list](respond-file-alerts.md#remove-file-from-blocked-list)
|
||||
###### [Check activity details in Action center](respond-file-alerts.md#check-activity-details-in-action-center)
|
||||
###### [Deep analysis](respond-file-alerts.md#deep-analysis)
|
||||
###### [Submit files for analysis](respond-file-alerts.md#submit-files-for-analysis)
|
||||
###### [View deep analysis reports](respond-file-alerts.md#view-deep-analysis-reports)
|
||||
###### [Troubleshoot deep analysis](respond-file-alerts.md#troubleshoot-deep-analysis)
|
||||
|
||||
### [Automated investigation and remediation](automated-investigations-windows-defender-advanced-threat-protection.md)
|
||||
#### [Learn about the automated investigation and remediation dashboard](manage-auto-investigation-windows-defender-advanced-threat-protection.md)
|
||||
### [Automated investigation and remediation](automated-investigations.md)
|
||||
#### [Learn about the automated investigation and remediation dashboard](manage-auto-investigation.md)
|
||||
|
||||
|
||||
### [Secure score](overview-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
### [Secure score](overview-secure-score.md)
|
||||
### [Threat analytics](threat-analytics.md)
|
||||
|
||||
### [Microsoft Threat Experts](microsoft-threat-experts.md)
|
||||
|
||||
### [Threat analytics](threat-analytics.md)
|
||||
|
||||
### [Advanced hunting](overview-hunting-windows-defender-advanced-threat-protection.md)
|
||||
#### [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
##### [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
|
||||
##### [Advanced hunting query language best practices](advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
|
||||
### [Advanced hunting](overview-hunting.md)
|
||||
#### [Query data using Advanced hunting](advanced-hunting.md)
|
||||
##### [Advanced hunting reference](advanced-hunting-reference.md)
|
||||
##### [Advanced hunting query language best practices](advanced-hunting-best-practices.md)
|
||||
#### [Custom detections](overview-custom-detections.md)
|
||||
#####[Create custom detections rules](custom-detection-rules.md)
|
||||
|
||||
### [Management and APIs](management-apis.md)
|
||||
#### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
|
||||
#### [Windows Defender ATP APIs](apis-intro.md)
|
||||
#### [Managed security service provider support](mssp-support-windows-defender-advanced-threat-protection.md)
|
||||
#### [Understand threat intelligence concepts](threat-indicator-concepts.md)
|
||||
#### [Microsoft Defender ATP APIs](apis-intro.md)
|
||||
#### [Managed security service provider support](mssp-support.md)
|
||||
|
||||
### [Microsoft Threat Protection](threat-protection-integration.md)
|
||||
#### [Protect users, data, and devices with conditional access](conditional-access-windows-defender-advanced-threat-protection.md)
|
||||
#### [Protect users, data, and devices with conditional access](conditional-access.md)
|
||||
#### [Microsoft Cloud App Security in Windows overview](microsoft-cloud-app-security-integration.md)
|
||||
#### [Information protection in Windows overview](information-protection-in-windows-overview.md)
|
||||
|
||||
### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
### [Microsoft Threat Experts](microsoft-threat-experts.md)
|
||||
|
||||
|
||||
### [Portal overview](portal-overview.md)
|
||||
|
||||
|
||||
## [Get started](get-started.md)
|
||||
### [What's new in Windows Defender ATP](whats-new-in-windows-defender-atp.md)
|
||||
### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md)
|
||||
### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md)
|
||||
### [Preview features](preview-windows-defender-advanced-threat-protection.md)
|
||||
### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)
|
||||
### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md)
|
||||
### [What's new in Microsoft Defender ATP](whats-new-in-microsoft-defender-atp.md)
|
||||
### [Minimum requirements](minimum-requirements.md)
|
||||
### [Validate licensing and complete setup](licensing.md)
|
||||
### [Preview features](preview.md)
|
||||
### [Data storage and privacy](data-storage-privacy.md)
|
||||
### [Assign user access to the portal](assign-portal-access.md)
|
||||
|
||||
### [Evaluate Windows Defender ATP](evaluate-atp.md)
|
||||
### [Evaluate Microsoft Defender ATP](evaluate-atp.md)
|
||||
####Evaluate attack surface reduction
|
||||
##### [Hardware-based isolation](../windows-defender-application-guard/test-scenarios-wd-app-guard.md)
|
||||
##### [Application control](../windows-defender-application-control/audit-windows-defender-application-control-policies.md)
|
||||
@ -121,7 +126,7 @@
|
||||
##### [Network firewall](../windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md)
|
||||
#### [Evaluate next generation protection](../windows-defender-antivirus/evaluate-windows-defender-antivirus.md)
|
||||
|
||||
### [Access the Windows Defender Security Center Community Center](community-windows-defender-advanced-threat-protection.md)
|
||||
### [Access the Microsoft Defender Security Center Community Center](community.md)
|
||||
|
||||
## [Configure and manage capabilities](onboard.md)
|
||||
### [Configure attack surface reduction](configure-attack-surface-reduction.md)
|
||||
@ -211,32 +216,32 @@
|
||||
##### [Use the mpcmdrun.exe command line tool to manage next generation protection](../windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md)
|
||||
|
||||
|
||||
### [Configure Secure score dashboard security controls](secure-score-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
### [Configure Secure score dashboard security controls](secure-score-dashboard.md)
|
||||
|
||||
### [Configure and manage Microsoft Threat Experts capabilities](configure-microsoft-threat-experts.md)
|
||||
|
||||
### Management and API support
|
||||
#### [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
####### [Onboard machines using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune)
|
||||
###### [Onboard machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
#### [Onboard machines](onboard-configure.md)
|
||||
##### [Onboard previous versions of Windows](onboard-downlevel.md)
|
||||
##### [Onboard Windows 10 machines](configure-endpoints.md)
|
||||
###### [Onboard machines using Group Policy](configure-endpoints-gp.md)
|
||||
###### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm.md)
|
||||
###### [Onboard machines using Mobile Device Management tools](configure-endpoints-mdm.md)
|
||||
####### [Onboard machines using Microsoft Intune](configure-endpoints-mdm.md#onboard-machines-using-microsoft-intune)
|
||||
###### [Onboard machines using a local script](configure-endpoints-script.md)
|
||||
###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md)
|
||||
##### [Onboard servers](configure-server-endpoints.md)
|
||||
##### [Onboard non-Windows machines](configure-endpoints-non-windows.md)
|
||||
##### [Onboard machines without Internet access](onboard-offline-machines.md)
|
||||
##### [Run a detection test on a newly onboarded machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
##### [Run simulated attacks on machines](attack-simulations-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
###### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md)
|
||||
##### [Run a detection test on a newly onboarded machine](run-detection-test.md)
|
||||
##### [Run simulated attacks on machines](attack-simulations.md)
|
||||
##### [Configure proxy and Internet connectivity settings](configure-proxy-internet.md)
|
||||
##### [Troubleshoot onboarding issues](troubleshoot-onboarding.md)
|
||||
###### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages.md)
|
||||
|
||||
|
||||
#### [Windows Defender ATP API](use-apis.md)
|
||||
##### [Get started with Windows Defender ATP APIs](apis-intro.md)
|
||||
#### [Microsoft Defender ATP API](use-apis.md)
|
||||
##### [Get started with Microsoft Defender ATP APIs](apis-intro.md)
|
||||
###### [Hello World](api-hello-world.md)
|
||||
###### [Get access with application context](exposed-apis-create-app-webapp.md)
|
||||
###### [Get access with user context](exposed-apis-create-app-nativeapp.md)
|
||||
@ -244,65 +249,65 @@
|
||||
|
||||
###### [Advanced Hunting](run-advanced-query-api.md)
|
||||
|
||||
###### [Alert](alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [List alerts](get-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Create alert](create-alert-by-reference-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Update Alert](update-alert-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert related domains information](get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert related IPs information](get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [Alert](alerts.md)
|
||||
####### [List alerts](get-alerts.md)
|
||||
####### [Create alert](create-alert-by-reference.md)
|
||||
####### [Update Alert](update-alert.md)
|
||||
####### [Get alert information by ID](get-alert-info-by-id.md)
|
||||
####### [Get alert related domains information](get-alert-related-domain-info.md)
|
||||
####### [Get alert related file information](get-alert-related-files-info.md)
|
||||
####### [Get alert related IPs information](get-alert-related-ip-info.md)
|
||||
####### [Get alert related machine information](get-alert-related-machine-info.md)
|
||||
####### [Get alert related user information](get-alert-related-user-info.md)
|
||||
|
||||
###### [Machine](machine-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [List machines](get-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Add or Remove machine tags](add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Find machines by IP](find-machines-by-ip-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [Machine](machine.md)
|
||||
####### [List machines](get-machines.md)
|
||||
####### [Get machine by ID](get-machine-by-id.md)
|
||||
####### [Get machine log on users](get-machine-log-on-users.md)
|
||||
####### [Get machine related alerts](get-machine-related-alerts.md)
|
||||
####### [Add or Remove machine tags](add-or-remove-machine-tags.md)
|
||||
####### [Find machines by IP](find-machines-by-ip.md)
|
||||
|
||||
###### [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [List Machine Actions](get-machineactions-collection-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get Machine Action](get-machineaction-object-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Collect investigation package](collect-investigation-package-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get investigation package SAS URI](get-package-sas-uri-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Isolate machine](isolate-machine-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Release machine from isolation](unisolate-machine-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Restrict app execution](restrict-code-execution-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Remove app restriction](unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Run antivirus scan](run-av-scan-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Offboard machine](offboard-machine-api-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Stop and quarantine file](stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Initiate investigation (preview)](initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [Machine Action](machineaction.md)
|
||||
####### [List Machine Actions](get-machineactions-collection.md)
|
||||
####### [Get Machine Action](get-machineaction-object.md)
|
||||
####### [Collect investigation package](collect-investigation-package.md)
|
||||
####### [Get investigation package SAS URI](get-package-sas-uri.md)
|
||||
####### [Isolate machine](isolate-machine.md)
|
||||
####### [Release machine from isolation](unisolate-machine.md)
|
||||
####### [Restrict app execution](restrict-code-execution.md)
|
||||
####### [Remove app restriction](unrestrict-code-execution.md)
|
||||
####### [Run antivirus scan](run-av-scan.md)
|
||||
####### [Offboard machine](offboard-machine-api.md)
|
||||
####### [Stop and quarantine file](stop-and-quarantine-file.md)
|
||||
####### [Initiate investigation (preview)](initiate-autoir-investigation.md)
|
||||
|
||||
###### [Indicators](ti-indicator-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Submit Indicator](post-ti-indicator-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [List Indicators](get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Delete Indicator](delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [Indicators](ti-indicator.md)
|
||||
####### [Submit Indicator](post-ti-indicator.md)
|
||||
####### [List Indicators](get-ti-indicators-collection.md)
|
||||
####### [Delete Indicator](delete-ti-indicator-by-id.md)
|
||||
|
||||
###### Domain
|
||||
####### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get domain related alerts](get-domain-related-alerts.md)
|
||||
####### [Get domain related machines](get-domain-related-machines.md)
|
||||
####### [Get domain statistics](get-domain-statistics.md)
|
||||
####### [Is domain seen in organization](is-domain-seen-in-org.md)
|
||||
|
||||
###### [File](files-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get file information](get-file-information-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [File](files.md)
|
||||
####### [Get file information](get-file-information.md)
|
||||
####### [Get file related alerts](get-file-related-alerts.md)
|
||||
####### [Get file related machines](get-file-related-machines.md)
|
||||
####### [Get file statistics](get-file-statistics.md)
|
||||
|
||||
###### IP
|
||||
####### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get IP related alerts](get-ip-related-alerts.md)
|
||||
####### [Get IP related machines](get-ip-related-machines.md)
|
||||
####### [Get IP statistics](get-ip-statistics.md)
|
||||
####### [Is IP seen in organization](is-ip-seen-org.md)
|
||||
|
||||
###### [User](user-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [User](user.md)
|
||||
####### [Get user related alerts](get-user-related-alerts.md)
|
||||
####### [Get user related machines](get-user-related-machines.md)
|
||||
|
||||
##### How to use APIs - Samples
|
||||
###### Advanced Hunting API
|
||||
@ -316,89 +321,91 @@
|
||||
|
||||
|
||||
#### API for custom alerts
|
||||
##### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md)
|
||||
##### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md)
|
||||
##### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md)
|
||||
##### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable the custom threat intelligence application](enable-custom-ti.md)
|
||||
##### [Use the threat intelligence API to create custom alerts](use-custom-ti.md)
|
||||
##### [Create custom threat intelligence alerts](custom-ti-api.md)
|
||||
##### [PowerShell code examples](powershell-example-code.md)
|
||||
##### [Python code examples](python-example-code.md)
|
||||
##### [Experiment with custom threat intelligence alerts](experiment-custom-ti.md)
|
||||
##### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti.md)
|
||||
|
||||
|
||||
#### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure Splunk to pull alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure HP ArcSight to pull alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
##### [Windows Defender ATP SIEM alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md)
|
||||
##### [Pull alerts using SIEM REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
##### [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md)
|
||||
#### [Pull alerts to your SIEM tools](configure-siem.md)
|
||||
##### [Enable SIEM integration](enable-siem-integration.md)
|
||||
##### [Configure Splunk to pull alerts](configure-splunk.md)
|
||||
##### [Configure HP ArcSight to pull alerts](configure-arcsight.md)
|
||||
##### [Microsoft Defender ATP SIEM alert API fields](api-portal-mapping.md)
|
||||
##### [Pull alerts using SIEM REST API](pull-alerts-using-rest-api.md)
|
||||
##### [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||
|
||||
|
||||
#### Reporting
|
||||
##### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Threat protection reports](threat-protection-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Machine health and compliance reports](machine-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Create and build Power BI reports using Microsoft Defender ATP data](powerbi-reports.md)
|
||||
##### [Threat protection reports](threat-protection-reports.md)
|
||||
##### [Machine health and compliance reports](machine-reports.md)
|
||||
|
||||
|
||||
#### Interoperability
|
||||
##### [Partner applications](partner-applications.md)
|
||||
|
||||
#### Role-based access control
|
||||
##### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
|
||||
###### [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md)
|
||||
###### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md)
|
||||
####### [Create and manage machine tags](machine-tags-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage portal access using RBAC](rbac.md)
|
||||
###### [Create and manage roles](user-roles.md)
|
||||
###### [Create and manage machine groups](machine-groups.md)
|
||||
####### [Create and manage machine tags](machine-tags.md)
|
||||
|
||||
#### [Configure managed security service provider (MSSP) support](configure-mssp-support-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure managed security service provider (MSSP) support](configure-mssp-support.md)
|
||||
|
||||
### Configure Microsoft Threat Protection integration
|
||||
#### [Configure conditional access](configure-conditional-access-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure conditional access](configure-conditional-access.md)
|
||||
#### [Configure Microsoft Cloud App Security in Windows](microsoft-cloud-app-security-config.md)
|
||||
####[Configure information protection in Windows](information-protection-in-windows-config.md)
|
||||
|
||||
|
||||
### [Configure Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md)
|
||||
### [Configure Microsoft Defender Security Center settings](preferences-setup.md)
|
||||
#### General
|
||||
##### [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable and create Power BI reports using Windows Security app data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md)
|
||||
##### [Update data retention settings](data-retention-settings.md)
|
||||
##### [Configure alert notifications](configure-email-notifications.md)
|
||||
##### [Enable and create Power BI reports using Windows Security app data](powerbi-reports.md)
|
||||
##### [Enable Secure score security controls](enable-secure-score.md)
|
||||
##### [Configure advanced features](advanced-features.md)
|
||||
|
||||
#### Permissions
|
||||
##### [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
|
||||
###### [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md)
|
||||
###### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md)
|
||||
####### [Create and manage machine tags](machine-tags-windows-defender-advanced-threat-protection.md)
|
||||
##### [Use basic permissions to access the portal](basic-permissions.md)
|
||||
##### [Manage portal access using RBAC](rbac.md)
|
||||
###### [Create and manage roles](user-roles.md)
|
||||
###### [Create and manage machine groups](machine-groups.md)
|
||||
####### [Create and manage machine tags](machine-tags.md)
|
||||
|
||||
#### APIs
|
||||
##### [Enable Threat intel](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable Threat intel](enable-custom-ti.md)
|
||||
##### [Enable SIEM integration](enable-siem-integration.md)
|
||||
|
||||
####Rules
|
||||
##### [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage suppression rules](manage-suppression-rules.md)
|
||||
##### [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list.md)
|
||||
##### [Manage indicators](manage-indicators.md)
|
||||
##### [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation file uploads](manage-automation-file-uploads.md)
|
||||
##### [Manage automation folder exclusions](manage-automation-folder-exclusions.md)
|
||||
|
||||
####Machine management
|
||||
##### [Onboarding machines](onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
##### [Offboarding machines](offboard-machines-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboarding machines](onboard-configure.md)
|
||||
##### [Offboarding machines](offboard-machines.md)
|
||||
|
||||
#### [Configure Windows Security app time zone settings](time-settings-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure Windows Security app time zone settings](time-settings.md)
|
||||
|
||||
## [Troubleshoot Windows Defender ATP](troubleshoot-wdatp.md)
|
||||
|
||||
|
||||
## [Troubleshoot Microsoft Defender ATP](troubleshoot-mdatp.md)
|
||||
###Troubleshoot sensor state
|
||||
#### [Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md)
|
||||
#### [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
#### [Inactive machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines)
|
||||
#### [Misconfigured machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines)
|
||||
#### [Review sensor events and errors on machines with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md)
|
||||
#### [Check sensor state](check-sensor-status.md)
|
||||
#### [Fix unhealthy sensors](fix-unhealthy-sensors.md)
|
||||
#### [Inactive machines](fix-unhealthy-sensors.md#inactive-machines)
|
||||
#### [Misconfigured machines](fix-unhealthy-sensors.md#misconfigured-machines)
|
||||
#### [Review sensor events and errors on machines with Event Viewer](event-error-codes.md)
|
||||
|
||||
### [Troubleshoot Windows Defender ATP service issues](troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
#### [Check service health](service-status-windows-defender-advanced-threat-protection.md)
|
||||
### [Troubleshoot Microsoft Defender ATP service issues](troubleshoot-mdatp.md)
|
||||
#### [Check service health](service-status.md)
|
||||
|
||||
###Troubleshoot attack surface reduction
|
||||
#### [Network protection](../windows-defender-exploit-guard/troubleshoot-np.md)
|
||||
@ -19,12 +19,12 @@ ms.topic: article
|
||||
# Add or Remove Machine Tags API
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Windows Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
This API adds or remove tag to a specific machine.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
@ -33,8 +33,8 @@ Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine
|
||||
|
||||
>[!Note]
|
||||
> When obtaining a token using user credentials:
|
||||
>- The user needs to have at least the following role permission: 'Manage security setting' (See [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) for more information)
|
||||
>- User needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) for more information)
|
||||
>- The user needs to have at least the following role permission: 'Manage security setting' (See [Create and manage roles](user-roles.md) for more information)
|
||||
>- User needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information)
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 - Ok response code and the updated Machin
|
||||
|
||||
Here is an example of a request that adds machine tag.
|
||||
|
||||
[!include[Improve request performance](improverequestperformance-new.md)]
|
||||
[!include[Improve request performance](improve-request-performance.md)]
|
||||
|
||||
```
|
||||
POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/tags
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure advanced features in Windows Defender ATP
|
||||
description: Turn on advanced features such as block file in Windows Defender Advanced Threat Protection.
|
||||
title: Configure advanced features in Microsoft Defender ATP
|
||||
description: Turn on advanced features such as block file in Microsoft Defender Advanced Threat Protection.
|
||||
keywords: advanced features, settings, block file, automated investigation, auto-resolve, skype, azure atp, office 365, azure information protection, intune
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -17,19 +17,19 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Configure advanced features in Windows Defender ATP
|
||||
# Configure advanced features in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink)
|
||||
|
||||
Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Windows Defender ATP with.
|
||||
Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Microsoft Defender ATP with.
|
||||
|
||||
Use the following advanced features to get better protected from potentially malicious files and gain better insight during security investigations:
|
||||
|
||||
## Automated investigation
|
||||
When you enable this feature, you'll be able to take advantage of the automated investigation and remediation features of the service. For more information, see [Automated investigations](automated-investigations-windows-defender-advanced-threat-protection.md).
|
||||
When you enable this feature, you'll be able to take advantage of the automated investigation and remediation features of the service. For more information, see [Automated investigations](automated-investigations.md).
|
||||
|
||||
## Auto-resolve remediated alerts
|
||||
For tenants created on or after Windows 10, version 1809 the automated investigations capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you don’t want to have alerts auto-resolved, you’ll need to manually turn off the feature.
|
||||
@ -43,7 +43,7 @@ For tenants created on or after Windows 10, version 1809 the automated investiga
|
||||
|
||||
|
||||
## Block file
|
||||
This feature is only available if your organization uses Windows Defender Antivirus as the active antimalware solution and that the cloud-based protection feature is enabled, see [Block files in your network](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#block-files-in-your-network) for more details.
|
||||
This feature is only available if your organization uses Windows Defender Antivirus as the active antimalware solution and that the cloud-based protection feature is enabled, see [Block files in your network](respond-file-alerts.md#block-files-in-your-network) for more details.
|
||||
|
||||
If your organization satisfies these conditions, the feature is enabled by default. This feature enables you to block potentially malicious files in your network. This operation will prevent it from being read, written, or executed on machines in your organization.
|
||||
|
||||
@ -53,7 +53,7 @@ When you enable this feature, you'll be able to see user details stored in Azure
|
||||
- Alert queue
|
||||
- Machine details page
|
||||
|
||||
For more information, see [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md).
|
||||
For more information, see [Investigate a user account](investigate-user.md).
|
||||
|
||||
## Skype for Business integration
|
||||
Enabling the Skype for Business integration gives you the ability to communicate with users using Skype for Business, email, or phone. This can be handy when you need to communicate with the user and mitigate risks.
|
||||
@ -69,7 +69,7 @@ The integration with Azure Advanced Threat Protection allows you to pivot direct
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
### Enable the Windows Defender ATP integration from the Azure ATP portal
|
||||
### Enable the Microsoft Defender ATP integration from the Azure ATP portal
|
||||
To receive contextual machine integration in Azure ATP, you'll also need to enable the feature in the Azure ATP portal.
|
||||
|
||||
1. Login to the [Azure portal](https://portal.atp.azure.com/) with a Global Administrator or Security Administrator role.
|
||||
@ -83,21 +83,21 @@ When you complete the integration steps on both portals, you'll be able to see r
|
||||
## Office 365 Threat Intelligence connection
|
||||
This feature is only available if you have an active Office 365 E5 or the Threat Intelligence add-on. For more information, see the Office 365 Enterprise E5 product page.
|
||||
|
||||
When you enable this feature, you'll be able to incorporate data from Office 365 Advanced Threat Protection into Windows Defender Security Center to conduct a holistic security investigation across Office 365 mailboxes and Windows machines.
|
||||
When you enable this feature, you'll be able to incorporate data from Office 365 Advanced Threat Protection into Microsoft Defender Security Center to conduct a holistic security investigation across Office 365 mailboxes and Windows machines.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
To receive contextual machine integration in Office 365 Threat Intelligence, you'll need to enable the Windows Defender ATP settings in the Security & Compliance dashboard. For more information, see [Office 365 Threat Intelligence overview](https://support.office.com/en-us/article/Office-365-Threat-Intelligence-overview-32405DA5-BEE1-4A4B-82E5-8399DF94C512).
|
||||
To receive contextual machine integration in Office 365 Threat Intelligence, you'll need to enable the Microsoft Defender ATP settings in the Security & Compliance dashboard. For more information, see [Office 365 Threat Intelligence overview](https://support.office.com/en-us/article/Office-365-Threat-Intelligence-overview-32405DA5-BEE1-4A4B-82E5-8399DF94C512).
|
||||
|
||||
## Microsoft Threat Experts
|
||||
Out of the two Microsoft Threat Expert components, targeted attack notification is in general availability, while experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. You can receive targeted attack notifications from Microsoft Threat Experts through your Windows Defender ATP portal's alerts dashboard and via email if you configure it.
|
||||
Out of the two Microsoft Threat Expert components, targeted attack notification is in general availability, while experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. You can receive targeted attack notifications from Microsoft Threat Experts through your Microsoft Defender ATP portal's alerts dashboard and via email if you configure it.
|
||||
|
||||
>[!NOTE]
|
||||
>The Microsoft Threat Experts capability in Windows Defender ATP is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security).
|
||||
>The Microsoft Threat Experts capability in Microsoft Defender ATP is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security).
|
||||
|
||||
## Microsoft Cloud App Security
|
||||
Enabling this setting forwards Windows Defender ATP signals to Microsoft Cloud App Security to provide deeper visibility into cloud application usage. Forwarded data is stored and processed in the same location as your Cloud App Security data.
|
||||
Enabling this setting forwards Microsoft Defender ATP signals to Microsoft Cloud App Security to provide deeper visibility into cloud application usage. Forwarded data is stored and processed in the same location as your Cloud App Security data.
|
||||
|
||||
>[!NOTE]
|
||||
>This feature is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10 version 1809 or later.
|
||||
@ -109,14 +109,14 @@ Turning this setting on forwards signals to Azure Information Protection, giving
|
||||
## Microsoft Intune connection
|
||||
This feature is only available if you have an active Microsoft Intune (Intune) license.
|
||||
|
||||
When you enable this feature, you'll be able to share Windows Defender ATP device information to Intune and enhance policy enforcement.
|
||||
When you enable this feature, you'll be able to share Microsoft Defender ATP device information to Intune and enhance policy enforcement.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to enable the integration on both Intune and Windows Defender ATP to use this feature.
|
||||
>You'll need to enable the integration on both Intune and Microsoft Defender ATP to use this feature.
|
||||
|
||||
|
||||
## Preview features
|
||||
Learn about new features in the Windows Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience.
|
||||
Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience.
|
||||
|
||||
You'll have access to upcoming features which you can provide feedback on to help improve the overall experience before features are generally available.
|
||||
|
||||
@ -126,7 +126,7 @@ You'll have access to upcoming features which you can provide feedback on to hel
|
||||
3. Click **Save preferences**.
|
||||
|
||||
## Related topics
|
||||
- [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable Secure Score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
- [Update data retention settings](data-retention-settings.md)
|
||||
- [Configure alert notifications](configure-email-notifications.md)
|
||||
- [Enable and create Power BI reports using Microsoft Defender ATP data](powerbi-reports.md)
|
||||
- [Enable Secure Score security controls](enable-secure-score.md)
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Advanced hunting best practices in Windows Defender ATP
|
||||
title: Advanced hunting best practices in Microsoft Defender ATP
|
||||
description: Learn about Advanced hunting best practices such as what filters and keywords to use to effectively query data.
|
||||
keywords: advanced hunting, best practices, keyword, filters, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,16 +18,13 @@ ms.topic: conceptual
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
# Advanced hunting query best practices Windows Defender ATP
|
||||
# Advanced hunting query best practices Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-abovefoldlink)
|
||||
|
||||
## Performance best practices
|
||||
The following best practices serve as a guideline of query performance best practices and for you to get faster results and be able to run complex queries.
|
||||
@ -42,7 +39,7 @@ The following best practices serve as a guideline of query performance best prac
|
||||
|
||||
### Unique Process IDs
|
||||
Process IDs are recycled in Windows and reused for new processes and therefore can't serve as a unique identifier for a specific process.
|
||||
To address this issue, Windows Defender ATP created the time process. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time.
|
||||
To address this issue, Microsoft Defender ATP created the time process. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time.
|
||||
|
||||
|
||||
So, when you join data based on a specific process or summarize data for each process, you'll need to use a machine identifier (either MachineId or ComputerName), a process ID (ProcessId or InitiatingProcessId) and the process creation time (ProcessCreationTime or InitiatingProcessCreationTime)
|
||||
@ -68,6 +65,7 @@ There are numerous ways to construct a command line to accomplish a task.
|
||||
For example, a malicious attacker could specify the process image file name without a path, with full path, without the file extension, using environment variables, add quotes, and others. In addition, the attacker can also change the order of some parameters, add multiple quotes or spaces, and much more.
|
||||
|
||||
To create more durable queries using command lines, we recommended the following guidelines:
|
||||
|
||||
- Identify the known processes (such as net.exe, psexec.exe, and others) by matching on the filename fields, instead of filtering on the command line field.
|
||||
- When querying for command line arguments, don't look for an exact match on multiple unrelated arguments in a certain order. Instead, use regular expressions or use multiple separate contains operators.
|
||||
- Use case insensitive matches. For example, use '=~', 'in~', 'contains' instead of '==', 'in' or 'contains_cs'
|
||||
@ -92,7 +90,7 @@ ProcessCreationEvents
|
||||
| where CanonicalCommandLine contains "stop" and CanonicalCommandLine contains "MpsSvc"
|
||||
```
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-belowfoldlink)
|
||||
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Advanced hunting reference in Windows Defender ATP
|
||||
title: Advanced hunting reference in Microsoft Defender ATP
|
||||
description: Learn about Advanced hunting table reference such as column name, data type, and description
|
||||
keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,17 +18,13 @@ ms.topic: article
|
||||
ms.date: 06/01/2018
|
||||
---
|
||||
|
||||
# Advanced hunting reference in Windows Defender ATP
|
||||
# Advanced hunting reference in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
## Advanced hunting column reference
|
||||
To effectively build queries that span multiple tables, you need to understand the columns in the Advanced hunting schema. The following table lists all the available columns, along with their data types and descriptions. This information is also available in the schema representation in the Advanced hunting screen.
|
||||
@ -104,7 +100,7 @@ To effectively build queries that span multiple tables, you need to understand t
|
||||
| ProcessIntegrityLevel | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources. |
|
||||
| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process |
|
||||
| Protocol | string | IP protocol used, whether TCP or UDP |
|
||||
| PublicIP | string | Public IP address used by the onboarded machine to connect to the Windows Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy. |
|
||||
| PublicIP | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy. |
|
||||
| RegistryKey | string | Registry key that the recorded action was applied to |
|
||||
| RegistryValueData | string | Data of the registry value that the recorded action was applied to |
|
||||
| RegistryValueName | string | Name of the registry value that the recorded action was applied to |
|
||||
@ -124,8 +120,8 @@ To effectively build queries that span multiple tables, you need to understand t
|
||||
| Table | string | Table that contains the details of the event |
|
||||
| TunnelingType | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH |
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-belowfoldlink)
|
||||
|
||||
## Related topic
|
||||
- [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
- [Advanced hunting query language best practices](advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
|
||||
## Related topics
|
||||
- [Query data using Advanced hunting](advanced-hunting.md)
|
||||
- [Advanced hunting query language best practices](advanced-hunting-best-practices.md)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Query data using Advanced hunting in Windows Defender ATP
|
||||
description: Learn about Advanced hunting in Windows Defender ATP and how to query ATP data.
|
||||
title: Query data using Advanced hunting in Microsoft Defender ATP
|
||||
description: Learn about Advanced hunting in Microsoft Defender ATP and how to query ATP data.
|
||||
keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,9 +18,9 @@ ms.topic: article
|
||||
ms.date: 08/15/2018
|
||||
---
|
||||
|
||||
# Query data using Advanced hunting in Windows Defender ATP
|
||||
# Query data using Advanced hunting in Microsoft Defender ATP
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
To get you started in querying your data, you can use the basic or Advanced query examples that have some preloaded queries for you to understand the basic query syntax.
|
||||
@ -33,7 +33,7 @@ A typical query starts with a table name followed by a series of operators separ
|
||||
|
||||
In the following example, we start with the table name **ProcessCreationEvents** and add piped elements as needed.
|
||||
|
||||
|
||||
|
||||
|
||||
First, we define a time filter to review only records from the previous seven days.
|
||||
|
||||
@ -69,7 +69,7 @@ For more information on the query language and supported operators, see [Query
|
||||
|
||||
The following tables are exposed as part of Advanced hunting:
|
||||
|
||||
- **AlertEvents** - Alerts on Windows Defender Security Center
|
||||
- **AlertEvents** - Alerts on Microsoft Defender Security Center
|
||||
- **MachineInfo** - Machine information, including OS information
|
||||
- **MachineNetworkInfo** - Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains
|
||||
- **ProcessCreationEvents** - Process creation and related events
|
||||
@ -124,10 +124,10 @@ These steps guide you on modifying and overwriting an existing query.
|
||||
|
||||
The result set has several capabilities to provide you with effective investigation, including:
|
||||
|
||||
- Columns that return entity-related objects, such as Machine name, Machine ID, File name, SHA1, User, IP, and URL, are linked to their entity pages in Windows Defender Security Center.
|
||||
- Columns that return entity-related objects, such as Machine name, Machine ID, File name, SHA1, User, IP, and URL, are linked to their entity pages in Microsoft Defender Security Center.
|
||||
- You can right-click on a cell in the result set and add a filter to your written query. The current filtering options are **include**, **exclude** or **advanced filter**, which provides additional filtering options on the cell value. These cell values are part of the row set.
|
||||
|
||||
|
||||
|
||||
|
||||
## Filter results in Advanced hunting
|
||||
In Advanced hunting, you can use the advanced filter on the output result set of the query.
|
||||
@ -146,11 +146,11 @@ The filter selections will resolve as an additional query term and the results w
|
||||
Check out the [Advanced hunting repository](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). Contribute and use example queries shared by our customers.
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink)
|
||||
|
||||
## Related topic
|
||||
- [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
|
||||
- [Advanced hunting query language best practices](advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
|
||||
- [Advanced hunting reference](advanced-hunting-reference.md)
|
||||
- [Advanced hunting query language best practices](advanced-hunting-best-practices.md)
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,37 @@
|
||||
---
|
||||
title: Alerts queue in Microsoft Defender Security Center
|
||||
description: View and manage the alerts surfaced in Microsoft Defender Security Center
|
||||
keywords:
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 09/03/2018
|
||||
---
|
||||
|
||||
# Alerts queue in Microsoft Defender Security Center
|
||||
Learn how you can view and manage the queue so that you can effectively investigate threats seen on entities such as machines, files, or user accounts.
|
||||
|
||||
|
||||
## In this section
|
||||
Topic | Description
|
||||
:---|:---
|
||||
[View and organize the Alerts queue](alerts-queue.md) | Shows a list of alerts that were flagged in your network.
|
||||
[Manage alerts](manage-alerts.md) | Learn about how you can manage alerts such as change its status, assign it to a security operations member, and see the history of an alert.
|
||||
[Investigate alerts](investigate-alerts.md)| Investigate alerts that are affecting your network, understand what they mean, and how to resolve them.
|
||||
[Investigate files](investigate-files.md)| Investigate the details of a file associated with a specific alert, behaviour, or event.
|
||||
[Investigate machines](investigate-machines.md)| Investigate the details of a machine associated with a specific alert, behaviour, or event.
|
||||
[Investigate an IP address](investigate-ip.md) | Examine possible communication between machines in your network and external internet protocol (IP) addresses.
|
||||
[Investigate a domain](investigate-domain.md) | Investigate a domain to see if machines and servers in your network have been communicating with a known malicious domain.
|
||||
[Investigate a user account](investigate-user.md) | Identify user accounts with the most active alerts and investigate cases of potential compromised credentials.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: View and organize the Windows Defender ATP Alerts queue
|
||||
description: Learn about how the Windows Defender ATP alerts queues work, and how to sort and filter lists of alerts.
|
||||
title: View and organize the Microsoft Defender ATP Alerts queue
|
||||
description: Learn about how the Microsoft Defender ATP alerts queues work, and how to sort and filter lists of alerts.
|
||||
keywords: alerts, queues, alerts queue, sort, order, filter, manage alerts, new, in progress, resolved, newest, time in queue, severity, time period, microsoft threat experts alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,14 +18,12 @@ ms.topic: article
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
# View and organize the Windows Defender Advanced Threat Protection Alerts queue
|
||||
# View and organize the Microsoft Defender Advanced Threat Protection Alerts queue
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-alertsq-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-alertsq-abovefoldlink)
|
||||
|
||||
The **Alerts queue** shows a list of alerts that were flagged from machines in your network. By default, the queue displays alerts seen in the last 30 days in a grouped view, with the most recent alerts showing at the top of the list, helping you see the most recent alerts first.
|
||||
|
||||
@ -38,7 +36,6 @@ On the top navigation you can:
|
||||
- Navigate between pages
|
||||
- Apply filters
|
||||
|
||||
|
||||
|
||||
|
||||
## Sort, filter, and group the alerts queue
|
||||
@ -53,16 +50,15 @@ Medium </br>(Orange) | Threats rarely observed in the organization, such as anom
|
||||
Low </br>(Yellow) | Threats associated with prevalent malware and hack-tools that do not necessarily indicate an advanced threat targeting the organization.
|
||||
Informational </br>(Grey) | Informational alerts are those that might not be considered harmful to the network but might be good to keep track of.
|
||||
|
||||
|
||||
#### Understanding alert severity
|
||||
It is important to understand that the Windows Defender Antivirus (Windows Defender AV) and Windows Defender ATP alert severities are different because they represent different scopes.
|
||||
It is important to understand that the Windows Defender Antivirus (Windows Defender AV) and Microsoft Defender ATP alert severities are different because they represent different scopes.
|
||||
|
||||
The Windows Defender AV threat severity represents the absolute severity of the detected threat (malware), and is assigned based on the potential risk to the individual machine, if infected.
|
||||
|
||||
The Windows Defender ATP alert severity represents the severity of the detected behavior, the actual risk to the machine but more importantly the potential risk to the organization.
|
||||
The Microsoft Defender ATP alert severity represents the severity of the detected behavior, the actual risk to the machine but more importantly the potential risk to the organization.
|
||||
|
||||
So, for example:
|
||||
- The severity of a Windows Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage incurred.
|
||||
- The severity of a Microsoft Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage incurred.
|
||||
- An alert about a commercial malware was detected while executing, but blocked and remediated by Windows Defender AV, is categorized as "Low" because it may have caused some damage to the individual machine but poses no organizational threat.
|
||||
- An alert about malware detected while executing which can pose a threat not only to the individual machine but to the organization, regardless if it was eventually blocked, may be ranked as "Medium" or "High".
|
||||
- Suspicious behavioral alerts which were not blocked or remediated will be ranked "Low", "Medium" or "High" following the same organizational threat considerations.
|
||||
@ -90,15 +86,14 @@ Limit the alerts queue view by selecting the OS platform that you're interested
|
||||
If you have specific machine groups that you're interested in checking the alerts on, you can select the groups to limit the alerts queue view to display just those machine groups.
|
||||
|
||||
### Associated threat
|
||||
Use this filter to focus on alerts that are related to high profile threats. You can see the full list of high-profile threats in [Threat analytics](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
Use this filter to focus on alerts that are related to high profile threats. You can see the full list of high-profile threats in [Threat analytics](threat-analytics.md).
|
||||
|
||||
## Related topics
|
||||
- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts.md)
|
||||
- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts.md)
|
||||
- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files.md)
|
||||
- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md)
|
||||
- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip.md)
|
||||
- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain.md)
|
||||
- [Investigate a user account in Microsoft Defender ATP](investigate-user.md)
|
||||
|
||||
@ -18,21 +18,21 @@ ms.topic: article
|
||||
|
||||
# Alert resource type
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Represents an alert entity in Windows Defender ATP.
|
||||
Represents an alert entity in Microsoft Defender ATP.
|
||||
|
||||
# Methods
|
||||
Method|Return Type |Description
|
||||
:---|:---|:---
|
||||
[Get alert](get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md) | [Alert](alerts-windows-defender-advanced-threat-protection-new.md) | Get a single [alert](alerts-windows-defender-advanced-threat-protection-new.md) object.
|
||||
[List alerts](get-alerts-windows-defender-advanced-threat-protection-new.md) | [Alert](alerts-windows-defender-advanced-threat-protection-new.md) collection | List [alert](alerts-windows-defender-advanced-threat-protection-new.md) collection.
|
||||
[Create alert](create-alert-by-reference-windows-defender-advanced-threat-protection-new.md)|[Alert](alerts-windows-defender-advanced-threat-protection-new.md)|Create an alert based on event data obtained from [Advanced Hunting](run-advanced-query-api.md).
|
||||
[List related domains](get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md)|Domain collection| List URLs associated with the alert.
|
||||
[List related files](get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md) | [File](files-windows-defender-advanced-threat-protection-new.md) collection | List the [file](files-windows-defender-advanced-threat-protection-new.md) entities that are associated with the [alert](alerts-windows-defender-advanced-threat-protection-new.md).
|
||||
[List related IPs](get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md) | IP collection | List IPs that are associated with the alert.
|
||||
[Get related machines](get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md) | [Machine](machine-windows-defender-advanced-threat-protection-new.md) | The [machine](machine-windows-defender-advanced-threat-protection-new.md) that is associated with the [alert](alerts-windows-defender-advanced-threat-protection-new.md).
|
||||
[Get related users](get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md) | [User](user-windows-defender-advanced-threat-protection-new.md) | The [user](user-windows-defender-advanced-threat-protection-new.md) that is associated with the [alert](alerts-windows-defender-advanced-threat-protection-new.md).
|
||||
[Get alert](get-alert-info-by-id.md) | [Alert](alerts.md) | Get a single [alert](alerts.md) object.
|
||||
[List alerts](get-alerts.md) | [Alert](alerts.md) collection | List [alert](alerts.md) collection.
|
||||
[Create alert](create-alert-by-reference.md)|[Alert](alerts.md)|Create an alert based on event data obtained from [Advanced Hunting](run-advanced-query-api.md).
|
||||
[List related domains](get-alert-related-domain-info.md)|Domain collection| List URLs associated with the alert.
|
||||
[List related files](get-alert-related-files-info.md) | [File](files.md) collection | List the [file](files.md) entities that are associated with the [alert](alerts.md).
|
||||
[List related IPs](get-alert-related-ip-info.md) | IP collection | List IPs that are associated with the alert.
|
||||
[Get related machines](get-alert-related-machine-info.md) | [Machine](machine.md) | The [machine](machine.md) that is associated with the [alert](alerts.md).
|
||||
[Get related users](get-alert-related-user-info.md) | [User](user.md) | The [user](user.md) that is associated with the [alert](alerts.md).
|
||||
|
||||
|
||||
# Properties
|
||||
@ -55,7 +55,7 @@ alertCreationTime | DateTimeOffset | The date and time (in UTC) the alert was cr
|
||||
lastEventTime | DateTimeOffset | The last occurance of the event that triggered the alert on the same machine.
|
||||
firstEventTime | DateTimeOffset | The first occurance of the event that triggered the alert on that machine.
|
||||
resolvedTime | DateTimeOffset | The date and time in which the status of the alert was changed to 'Resolved'.
|
||||
machineId | String | ID of a [machine](machine-windows-defender-advanced-threat-protection-new.md) entity that is associated with the alert.
|
||||
machineId | String | ID of a [machine](machine.md) entity that is associated with the alert.
|
||||
|
||||
# JSON representation
|
||||
```
|
||||
@ -16,12 +16,12 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Windows Defender ATP API - Hello World
|
||||
# Microsoft Defender ATP API - Hello World
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
## Get Alerts using a simple PowerShell script
|
||||
@ -50,7 +50,7 @@ For the App registration stage, you must have a Global administrator role in you
|
||||
|
||||
|
||||
|
||||
4. Allow your App to access Windows Defender ATP and assign it 'Read all alerts' permission:
|
||||
4. Allow your App to access Microsoft Defender ATP and assign it 'Read all alerts' permission:
|
||||
|
||||
- Click **Settings** > **Required permissions** > **Add**.
|
||||
|
||||
@ -184,6 +184,6 @@ You’re all done! You have just successfully:
|
||||
|
||||
|
||||
## Related topic
|
||||
- [Windows Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Windows Defender ATP with application context](exposed-apis-create-app-webapp.md)
|
||||
- [Access Windows Defender ATP with user context](exposed-apis-create-app-nativeapp.md)
|
||||
- [Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Microsoft Defender ATP with application context](exposed-apis-create-app-webapp.md)
|
||||
- [Access Microsoft Defender ATP with user context](exposed-apis-create-app-nativeapp.md)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Defender ATP alert API fields
|
||||
description: Understand how the alert API fields map to the values in Windows Defender Security Center
|
||||
title: Microsoft Defender ATP alert API fields
|
||||
description: Understand how the alert API fields map to the values in Microsoft Defender Security Center
|
||||
keywords: alerts, alert fields, fields, api, fields, pull alerts, rest api, request, response
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,26 +18,20 @@ ms.topic: article
|
||||
ms.date: 10/16/2017
|
||||
---
|
||||
|
||||
# Windows Defender ATP SIEM alert API fields
|
||||
# Microsoft Defender ATP SIEM alert API fields
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink)
|
||||
|
||||
Understand what data fields are exposed as part of the alerts API and how they map to Windows Defender Security Center.
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink)
|
||||
|
||||
Understand what data fields are exposed as part of the alerts API and how they map to Microsoft Defender Security Center.
|
||||
|
||||
## Alert API fields and portal mapping
|
||||
The following table lists the available fields exposed in the alerts API payload. It shows examples for the populated values and a reference on how data is reflected on the portal.
|
||||
|
||||
|
||||
The ArcSight field column contains the default mapping between the Windows Defender ATP fields and the built-in fields in ArcSight. You can download the mapping file from the portal when you enable the SIEM integration feature and you can modify it to match the needs of your organization. For more information, see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md).
|
||||
The ArcSight field column contains the default mapping between the Microsoft Defender ATP fields and the built-in fields in ArcSight. You can download the mapping file from the portal when you enable the SIEM integration feature and you can modify it to match the needs of your organization. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md).
|
||||
|
||||
Field numbers match the numbers in the images below.
|
||||
|
||||
@ -47,12 +41,12 @@ Field numbers match the numbers in the images below.
|
||||
| 1 | AlertTitle | name | A dll was unexpectedly loaded into a high integrity process without a UAC prompt | Value available for every alert. |
|
||||
| 2 | Severity | deviceSeverity | Medium | Value available for every alert. |
|
||||
| 3 | Category | deviceEventCategory | Privilege Escalation | Value available for every alert. |
|
||||
| 4 | Source | sourceServiceName | WindowsDefenderATP | Windows Defender Antivirus or Windows Defender ATP. Value available for every alert. |
|
||||
| 4 | Source | sourceServiceName | WindowsDefenderATP | Windows Defender Antivirus or Microsoft Defender ATP. Value available for every alert. |
|
||||
| 5 | MachineName | sourceHostName | liz-bean | Value available for every alert. |
|
||||
| 6 | FileName | fileName | Robocopy.exe | Available for alerts associated with a file or process. |
|
||||
| 7 | FilePath | filePath | C:\Windows\System32\Robocopy.exe | Available for alerts associated with a file or process. |
|
||||
| 8 | UserDomain | sourceNtDomain | contoso | The domain of the user context running the activity, available for Windows Defender ATP behavioral based alerts. |
|
||||
| 9 | UserName | sourceUserName | liz-bean | The user context running the activity, available for Windows Defender ATP behavioral based alerts. |
|
||||
| 8 | UserDomain | sourceNtDomain | contoso | The domain of the user context running the activity, available for Microsoft Defender ATP behavioral based alerts. |
|
||||
| 9 | UserName | sourceUserName | liz-bean | The user context running the activity, available for Microsoft Defender ATP behavioral based alerts. |
|
||||
| 10 | Sha1 | fileHash | 5b4b3985339529be3151d331395f667e1d5b7f35 | Available for alerts associated with a file or process. |
|
||||
| 11 | Md5 | deviceCustomString5 | 55394b85cb5edddff551f6f3faa9d8eb | Available for Windows Defender AV alerts. |
|
||||
| 12 | Sha256 | deviceCustomString6 | 9987474deb9f457ece2a9533a08ec173a0986fa3aa6ac355eeba5b622e4a43f5 | Available for Windows Defender AV alerts. |
|
||||
@ -72,7 +66,7 @@ Field numbers match the numbers in the images below.
|
||||
| | InternalIPv6List | No mapping | fd30:0000:0000:0001:ff4e:003e:0009:000e, FE80:CD00:0000:0CDE:1257:0000:211E:729C | List of IPV6 internal IPs for active network interfaces. |
|
||||
| Internal field | LastProcessedTimeUtc | No mapping | 2017-05-07T01:56:58.9936648Z | Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that alerts are retrieved. |
|
||||
| | Not part of the schema | deviceVendor | | Static value in the ArcSight mapping - 'Microsoft'. |
|
||||
| | Not part of the schema | deviceProduct | | Static value in the ArcSight mapping - 'Windows Defender ATP'. |
|
||||
| | Not part of the schema | deviceProduct | | Static value in the ArcSight mapping - 'Microsoft Defender ATP'. |
|
||||
| | Not part of the schema | deviceVersion | | Static value in the ArcSight mapping - '2.0', used to identify the mapping versions.
|
||||
|
||||
|
||||
@ -92,8 +86,8 @@ Field numbers match the numbers in the images below.
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Defender Advanced Threat Protection API overview
|
||||
description: Learn how you can use APIs to automate workflows and innovate based on Windows Defender ATP capabilities
|
||||
title: Microsoft Defender Advanced Threat Protection API overview
|
||||
description: Learn how you can use APIs to automate workflows and innovate based on Microsoft Defender ATP capabilities
|
||||
keywords: apis, api, wdatp, open api, windows defender atp api, public api, supported apis, alerts, machine, user, domain, ip, file, advanced hunting, query
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -16,33 +16,33 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Windows Defender ATP API overview
|
||||
# Microsoft Defender ATP API overview
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
Windows Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Windows Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
||||
Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Microsoft Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
||||
|
||||
In general, you’ll need to take the following steps to use the APIs:
|
||||
- Create an AAD application
|
||||
- Get an access token using this application
|
||||
- Use the token to access Windows Defender ATP API
|
||||
- Use the token to access Microsoft Defender ATP API
|
||||
|
||||
|
||||
You can access Windows Defender ATP API with **Application Context** or **User Context**.
|
||||
You can access Microsoft Defender ATP API with **Application Context** or **User Context**.
|
||||
|
||||
- **Application Context: (Recommended)** <br>
|
||||
Used by apps that run without a signed-in user present. for example, apps that run as background services or daemons.
|
||||
|
||||
Steps that need to be taken to access Windows Defender ATP API with application context:
|
||||
Steps that need to be taken to access Microsoft Defender ATP API with application context:
|
||||
|
||||
1. Create an AAD Web-Application.
|
||||
2. Assign the desired permission to the application, for example, 'Read Alerts', 'Isolate Machines'.
|
||||
3. Create a key for this Application.
|
||||
4. Get token using the application with its key.
|
||||
5. Use the token to access Windows Defender ATP API
|
||||
5. Use the token to access Microsoft Defender ATP API
|
||||
|
||||
For more information, see [Get access with application context](exposed-apis-create-app-webapp.md).
|
||||
|
||||
@ -50,16 +50,16 @@ You can access Windows Defender ATP API with **Application Context** or **User C
|
||||
- **User Context:** <br>
|
||||
Used to perform actions in the API on behalf of a user.
|
||||
|
||||
Steps that needs to be taken to access Windows Defender ATP API with application context:
|
||||
Steps that needs to be taken to access Microsoft Defender ATP API with application context:
|
||||
1. Create AAD Native-Application.
|
||||
2. Assign the desired permission to the application, e.g 'Read Alerts', 'Isolate Machines' etc.
|
||||
3. Get token using the application with user credentials.
|
||||
4. Use the token to access Windows Defender ATP API
|
||||
4. Use the token to access Microsoft Defender ATP API
|
||||
|
||||
For more information, see [Get access with user context](exposed-apis-create-app-nativeapp.md).
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Windows Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Windows Defender ATP with application context](exposed-apis-create-app-webapp.md)
|
||||
- [Access Windows Defender ATP with user context](exposed-apis-create-app-nativeapp.md)
|
||||
- [Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Microsoft Defender ATP with application context](exposed-apis-create-app-webapp.md)
|
||||
- [Access Microsoft Defender ATP with user context](exposed-apis-create-app-nativeapp.md)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Assign user access to Windows Defender Security Center
|
||||
description: Assign read and write or read only access to the Windows Defender Advanced Threat Protection portal.
|
||||
title: Assign user access to Microsoft Defender Security Center
|
||||
description: Assign read and write or read only access to the Microsoft Defender Advanced Threat Protection portal.
|
||||
keywords: assign user roles, assign read and write access, assign read only access, user, user roles, roles
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,31 +18,28 @@ ms.topic: article
|
||||
ms.date: 11/28/2018
|
||||
---
|
||||
|
||||
# Assign user access to Windows Defender Security Center
|
||||
# Assign user access to Microsoft Defender Security Center
|
||||
|
||||
**Applies to:**
|
||||
- Azure Active Directory
|
||||
- Office 365
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-assignaccess-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-assignaccess-abovefoldlink)
|
||||
|
||||
Windows Defender ATP supports two ways to manage permissions:
|
||||
Microsoft Defender ATP supports two ways to manage permissions:
|
||||
|
||||
- **Basic permissions management**: Set permissions to either full access or read-only.
|
||||
- **Role-based access control (RBAC)**: Set granular permissions by defining roles, assigning Azure AD user groups to the roles, and granting the user groups access to machine groups. For more information on RBAC, see [Manage portal access using role-based access control](rbac-windows-defender-advanced-threat-protection.md).
|
||||
- **Role-based access control (RBAC)**: Set granular permissions by defining roles, assigning Azure AD user groups to the roles, and granting the user groups access to machine groups. For more information on RBAC, see [Manage portal access using role-based access control](rbac.md).
|
||||
|
||||
> [!NOTE]
|
||||
>If you have already assigned basic permissions, you may switch to RBAC anytime. Consider the following before making the switch:
|
||||
|
||||
>- Users with full access (users that are assigned the Global Administrator or Security Administrator directory role in Azure AD), are automatically assigned the default Windows Defender ATP administrator role, which also has full access. Additional Azure AD user groups can be assigned to the Windows Defender ATP administrator role after switching to RBAC. Only users assigned to the Windows Defender ATP administrator role can manage permissions using RBAC.
|
||||
>- Users with full access (users that are assigned the Global Administrator or Security Administrator directory role in Azure AD), are automatically assigned the default Microsoft Defender ATP administrator role, which also has full access. Additional Azure AD user groups can be assigned to the Microsoft Defender ATP administrator role after switching to RBAC. Only users assigned to the Microsoft Defender ATP administrator role can manage permissions using RBAC.
|
||||
>- Users that have read-only access (Security Readers) will lose access to the portal until they are assigned a role. Note that only Azure AD user groups can be assigned a role under RBAC.
|
||||
>- After switching to RBAC, you will not be able to switch back to using basic permissions management.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-portalaccess-belowfoldlink)
|
||||
|
||||
## Related topic
|
||||
- [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
|
||||
- [Use basic permissions to access the portal](basic-permissions.md)
|
||||
- [Manage portal access using RBAC](rbac.md)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Experience Windows Defender ATP through simulated attacks
|
||||
description: Run the provided attack scenario simulations to experience how Windows Defender ATP can detect, investigate, and respond to breaches.
|
||||
title: Experience Microsoft Defender ATP through simulated attacks
|
||||
description: Run the provided attack scenario simulations to experience how Microsoft Defender ATP can detect, investigate, and respond to breaches.
|
||||
keywords: wdatp, test, scenario, attack, simulation, simulated, diy, windows defender advanced threat protection
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,27 +18,23 @@ ms.topic: article
|
||||
ms.date: 11/20/2018
|
||||
---
|
||||
|
||||
# Experience Windows Defender ATP through simulated attacks
|
||||
# Experience Microsoft Defender ATP through simulated attacks
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink)
|
||||
|
||||
>[!TIP]
|
||||
>- Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
|
||||
>- Windows Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
|
||||
>- Learn about the latest enhancements in Microsoft Defender ATP: [What's new in Microsoft Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
|
||||
>- Microsoft Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
|
||||
|
||||
|
||||
You might want to experience Windows Defender ATP before you onboard more than a few machines to the service. To do this, you can run controlled attack simulations on a few test machines. After running the simulated attacks, you can review how Windows Defender ATP surfaces malicious activity and explore how it enables an efficient response.
|
||||
You might want to experience Microsoft Defender ATP before you onboard more than a few machines to the service. To do this, you can run controlled attack simulations on a few test machines. After running the simulated attacks, you can review how Microsoft Defender ATP surfaces malicious activity and explore how it enables an efficient response.
|
||||
|
||||
## Before you begin
|
||||
|
||||
To run any of the provided simulations, you need at least [one onboarded machine](onboard-configure-windows-defender-advanced-threat-protection.md).
|
||||
To run any of the provided simulations, you need at least [one onboarded machine](onboard-configure.md).
|
||||
|
||||
Read the walkthrough document provided with each attack scenario. Each document includes OS and application requirements as well as detailed instructions that are specific to an attack scenario.
|
||||
|
||||
@ -62,9 +58,10 @@ Read the walkthrough document provided with each attack scenario. Each document
|
||||
>Simulation files or scripts mimic attack activity but are actually benign and will not harm or compromise the test machine.
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-belowfoldlink)
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
- [Onboard machines](onboard-configure.md)
|
||||
- [Onboard Windows 10 machines](configure-endpoints.md)
|
||||
@ -19,17 +19,19 @@ ms.topic: conceptual
|
||||
|
||||
# Overview of Automated investigations
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink)
|
||||
|
||||
The Windows Defender ATP service has a wide breadth of visibility on multiple machines. With this kind of optics, the service generates a multitude of alerts. The volume of alerts generated can be challenging for a typical security operations team to individually address.
|
||||
The Microsoft Defender ATP service has a wide breadth of visibility on multiple machines. With this kind of optics, the service generates a multitude of alerts. The volume of alerts generated can be challenging for a typical security operations team to individually address.
|
||||
|
||||
|
||||
To address this challenge, Windows Defender ATP uses Automated investigations to significantly reduce the volume of alerts that need to be investigated individually. The Automated investigation feature leverages various inspection algorithms, and processes used by analysts (such as playbooks) to examine alerts and take immediate remediation action to resolve breaches. This significantly reduces alert volume, allowing security operations experts to focus on more sophisticated threats and other high value initiatives.
|
||||
To address this challenge, Microsoft Defender ATP uses Automated investigations to significantly reduce the volume of alerts that need to be investigated individually. The Automated investigation feature leverages various inspection algorithms, and processes used by analysts (such as playbooks) to examine alerts and take immediate remediation action to resolve breaches. This significantly reduces alert volume, allowing security operations experts to focus on more sophisticated threats and other high value initiatives.
|
||||
|
||||
The Automated investigations list shows all the investigations that have been initiated automatically and shows other details such as its status, detection source, and the date for when the investigation was initiated.
|
||||
|
||||
## Understand the Automated investigation flow
|
||||
|
||||
### How the Automated investigation starts
|
||||
|
||||
Entities are the starting point for Automated investigations. When an alert contains a supported entity for Automated investigation (for example, a file) that resides on a machine that has a supported operating system for Automated investigation then an Automated investigation can start.
|
||||
|
||||
>[!NOTE]
|
||||
@ -74,14 +76,14 @@ Semi - require approval for non-temp folders remediation | An approval is requir
|
||||
Semi - require approval for core folders remediation | An approval is required on files or executables that are in the operating system directories such as Windows folder and Program files folder. <br><br> Files or executables in all other folders will automatically be remediated if needed.
|
||||
Full - remediate threats automatically | All remediation actions will be performed automatically.
|
||||
|
||||
For more information on how to configure these automation levels, see [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md).
|
||||
For more information on how to configure these automation levels, see [Create and manage machine groups](machine-groups.md).
|
||||
|
||||
The default machine group is configured for semi-automatic remediation. This means that any malicious entity that needs to be remediated requires an approval and the investigation is added to the **Pending actions** section, this can be changed to fully automatic so that no user approval is needed.
|
||||
|
||||
When a pending action is approved, the entity is then remediated and this new state is reflected in the **Entities** tab of the investigation.
|
||||
|
||||
## Related topic
|
||||
- [Learn about the automated investigations dashboard](manage-auto-investigation-windows-defender-advanced-threat-protection.md)
|
||||
- [Learn about the automated investigations dashboard](manage-auto-investigation.md)
|
||||
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Use basic permissions to access Windows Defender Security Center
|
||||
description: Assign read and write or read only access to the Windows Defender Advanced Threat Protection portal.
|
||||
title: Use basic permissions to access Microsoft Defender Security Center
|
||||
description: Assign read and write or read only access to the Microsoft Defender Advanced Threat Protection portal.
|
||||
keywords: assign user roles, assign read and write access, assign read only access, user, user roles, roles
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -21,9 +21,9 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
|
||||
- Azure Active Directory
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-basicaccess-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-basicaccess-abovefoldlink)
|
||||
|
||||
Refer to the instructions below to use basic permissions management.
|
||||
|
||||
@ -31,7 +31,7 @@ You can use either of the following:
|
||||
- Azure PowerShell
|
||||
- Azure Portal
|
||||
|
||||
For granular control over permissions, [switch to role-based access control](rbac-windows-defender-advanced-threat-protection.md).
|
||||
For granular control over permissions, [switch to role-based access control](rbac.md).
|
||||
|
||||
## Assign user access using Azure PowerShell
|
||||
You can assign users with one of the following levels of permissions:
|
||||
@ -73,4 +73,4 @@ For more information, see [Assign administrator and non-administrator roles to u
|
||||
|
||||
|
||||
## Related topic
|
||||
- [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage portal access using RBAC](rbac.md)
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Check the health state of the sensor in Windows Defender ATP
|
||||
title: Check the health state of the sensor in Microsoft Defender ATP
|
||||
description: Check the sensor health on machines to identify which ones are misconfigured, inactive, or are not reporting sensor data.
|
||||
keywords: sensor, sensor health, misconfigured, inactive, no sensor data, sensor data, impaired communications, communication
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,38 +18,35 @@ ms.topic: article
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
# Check sensor health state in Windows Defender ATP
|
||||
# Check sensor health state in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-checksensor-abovefoldlink)
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-checksensor-abovefoldlink)
|
||||
|
||||
The sensor health tile provides information on the individual machine’s ability to provide sensor data and communicate with the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues.
|
||||
|
||||
The sensor health tile provides information on the individual machine’s ability to provide sensor data and communicate with the Microsoft Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues.
|
||||
|
||||
There are two status indicators on the tile that provide information on the number of machines that are not reporting properly to the service:
|
||||
- **Misconfigured** - These machines might partially be reporting sensor data to the Windows Defender ATP service and might have configuration errors that need to be corrected.
|
||||
- **Inactive** - Machines that have stopped reporting to the Windows Defender ATP service for more than seven days in the past month.
|
||||
- **Misconfigured** - These machines might partially be reporting sensor data to the Microsoft Defender ATP service and might have configuration errors that need to be corrected.
|
||||
- **Inactive** - Machines that have stopped reporting to the Microsoft Defender ATP service for more than seven days in the past month.
|
||||
|
||||
|
||||
Clicking any of the groups directs you to Machines list, filtered according to your choice.
|
||||
|
||||
You can also download the entire list in CSV format using the **Export to CSV** feature. For more information on filters, see [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md).
|
||||
You can also download the entire list in CSV format using the **Export to CSV** feature. For more information on filters, see [View and organize the Machines list](machines-view-overview.md).
|
||||
|
||||
You can filter the health state list by the following status:
|
||||
- **Active** - Machines that are actively reporting to the Windows Defender ATP service.
|
||||
- **Misconfigured** - These machines might partially be reporting sensor data to the Windows Defender ATP service but have configuration errors that need to be corrected. Misconfigured machines can have either one or a combination of the following issues:
|
||||
- **Active** - Machines that are actively reporting to the Microsoft Defender ATP service.
|
||||
- **Misconfigured** - These machines might partially be reporting sensor data to the Microsoft Defender ATP service but have configuration errors that need to be corrected. Misconfigured machines can have either one or a combination of the following issues:
|
||||
- **No sensor data** - Machines has stopped sending sensor data. Limited alerts can be triggered from the machine.
|
||||
- **Impaired communications** - Ability to communicate with machine is impaired. Sending files for deep analysis, blocking files, isolating machine from network and other actions that require communication with the machine may not work.
|
||||
- **Inactive** - Machines that have stopped reporting to the Windows Defender ATP service.
|
||||
- **Inactive** - Machines that have stopped reporting to the Microsoft Defender ATP service.
|
||||
|
||||
|
||||
You can view the machine details when you click on a misconfigured or inactive machine. You’ll see more specific machine information when you click the information icon.
|
||||
|
||||
|
||||
|
||||
|
||||
In the **Machines list**, you can download a full list of all the machines in your organization in a CSV format.
|
||||
|
||||
@ -57,4 +54,4 @@ In the **Machines list**, you can download a full list of all the machines in yo
|
||||
>Export the list in CSV format to display the unfiltered data. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself and can take a significant amount of time to download, depending on how large your organization is.
|
||||
|
||||
## Related topic
|
||||
- [Fix unhealthy sensors in Windows Defender ATP](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
- [Fix unhealthy sensors in Microsoft Defender ATP](fix-unhealthy-sensors.md)
|
||||
@ -19,14 +19,12 @@ ms.topic: article
|
||||
|
||||
# Collect investigation package API
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Collect investigation package from a machine.
|
||||
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
@ -35,8 +33,8 @@ Delegated (work or school account) | Machine.CollectForensics | 'Collect forensi
|
||||
|
||||
>[!Note]
|
||||
> When obtaining a token using user credentials:
|
||||
>- The user needs to have at least the following role permission: 'Alerts Investigation' (See [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) for more information)
|
||||
>- The user needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) for more information)
|
||||
>- The user needs to have at least the following role permission: 'Alerts Investigation' (See [Create and manage roles](user-roles.md) for more information)
|
||||
>- The user needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information)
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
@ -58,7 +56,7 @@ Parameter | Type | Description
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201 - Created response code and [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) in the response body.
|
||||
If successful, this method returns 201 - Created response code and [Machine Action](machineaction.md) in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
@ -67,7 +65,7 @@ If successful, this method returns 201 - Created response code and [Machine Acti
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
[!include[Improve request performance](improverequestperformance-new.md)]
|
||||
[!include[Improve request performance](improve-request-performance.md)]
|
||||
|
||||
```
|
||||
POST https://api.securitycenter.windows.com/api/machines/fb9ab6be3965095a09c057be7c90f0a2/collectInvestigationPackage
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Access the Windows Defender ATP Community Center
|
||||
description: Access the Windows Defender ATP Community Center to share experiences, engange, and learn about the product.
|
||||
title: Access the Microsoft Defender ATP Community Center
|
||||
description: Access the Microsoft Defender ATP Community Center to share experiences, engange, and learn about the product.
|
||||
keywords: community, community center, tech community, conversation, announcements
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -19,14 +19,14 @@ ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
|
||||
# Access the Windows Defender ATP Community Center
|
||||
# Access the Microsoft Defender ATP Community Center
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
The Windows Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product.
|
||||
The Microsoft Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product.
|
||||
|
||||
There are several spaces you can explore to learn about specific information:
|
||||
- Announcements
|
||||
@ -35,8 +35,8 @@ There are several spaces you can explore to learn about specific information:
|
||||
|
||||
|
||||
There are several ways you can access the Community Center:
|
||||
- In the Windows Defender Security Center navigation pane, select **Community center**. A new browser tab opens and takes you to the Windows Defender ATP Tech Community page.
|
||||
- Access the community through the [Windows Defender Advanced Threat Protection Tech Community](https://techcommunity.microsoft.com/t5/Windows-Defender-Advanced-Threat/ct-p/WindowsDefenderAdvanced) page
|
||||
- In the Microsoft Defender Security Center navigation pane, select **Community center**. A new browser tab opens and takes you to the Microsoft Defender ATP Tech Community page.
|
||||
- Access the community through the [Microsoft Defender Advanced Threat Protection Tech Community](https://techcommunity.microsoft.com/t5/Windows-Defender-Advanced-Threat/ct-p/WindowsDefenderAdvanced) page
|
||||
|
||||
|
||||
You can instantly view and read conversations that have been posted in the community.
|
||||
@ -20,11 +20,11 @@ ms.topic: article
|
||||
# Enable conditional access to better protect users, devices, and data
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-abovefoldlink)
|
||||
|
||||
Conditional access is a capability that helps you better protect your users and enterprise information by making sure that only secure devices have access to applications.
|
||||
|
||||
@ -32,7 +32,7 @@ With conditional access, you can control access to enterprise information based
|
||||
|
||||
You can define security conditions under which devices and applications can run and access information from your network by enforcing policies to stop applications from running until a device returns to a compliant state.
|
||||
|
||||
The implementation of conditional access in Windows Defender ATP is based on Microsoft Intune (Intune) device compliance policies and Azure Active Directory (Azure AD) conditional access policies.
|
||||
The implementation of conditional access in Microsoft Defender ATP is based on Microsoft Intune (Intune) device compliance policies and Azure Active Directory (Azure AD) conditional access policies.
|
||||
|
||||
The compliance policy is used with conditional access to allow only devices that fulfill one or more device compliance policy rules to access applications.
|
||||
|
||||
@ -56,21 +56,21 @@ There are three ways to address a risk:
|
||||
2. Resolve active alerts on the machine. This will remove the risk from the machine.
|
||||
3. You can remove the machine from the active policies and consequently, conditional access will not be applied on the machine.
|
||||
|
||||
Manual remediation requires a secops admin to investigate an alert and address the risk seen on the device. The automated remediation is configured through configuration settings provided in the following section, [Configure conditional access](configure-conditional-access-windows-defender-advanced-threat-protection.md).
|
||||
Manual remediation requires a secops admin to investigate an alert and address the risk seen on the device. The automated remediation is configured through configuration settings provided in the following section, [Configure conditional access](configure-conditional-access.md).
|
||||
|
||||
When the risk is removed either through manual or automated remediation, the device returns to a compliant state and access to applications is granted.
|
||||
|
||||
The following example sequence of events explains conditional access in action:
|
||||
|
||||
1. A user opens a malicious file and Windows Defender ATP flags the device as high risk.
|
||||
1. A user opens a malicious file and Microsoft Defender ATP flags the device as high risk.
|
||||
2. The high risk assessment is passed along to Intune. In parallel, an automated investigation is initiated to remediate the identified threat. A manual remediation can also be done to remediate the identified threat.
|
||||
3. Based on the policy created in Intune, the device is marked as not compliant. The assessment is then communicated to Azure AD by the Intune conditional access policy. In Azure AD, the corresponding policy is applied to block access to applications.
|
||||
4. The manual or automated investigation and remediation is completed and the threat is removed. Windows Defender ATP sees that there is no risk on the device and Intune assesses the device to be in a compliant state. Azure AD applies the policy which allows access to applications.
|
||||
4. The manual or automated investigation and remediation is completed and the threat is removed. Microsoft Defender ATP sees that there is no risk on the device and Intune assesses the device to be in a compliant state. Azure AD applies the policy which allows access to applications.
|
||||
5. Users can now access applications.
|
||||
|
||||
|
||||
## Related topic
|
||||
- [Configure conditional access in Windows Defender ATP](configure-conditional-access-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure conditional access in Microsoft Defender ATP](configure-conditional-access.md)
|
||||
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure Threat & Vulnerability Management in Windows Defender ATP
|
||||
title: Configure Threat & Vulnerability Management in Microsoft Defender ATP
|
||||
description: Configure your Threat & Vulnerability Management to allow security administrators and IT administrators to collaborate seamlessly to remediate issues via Microsoft intune and Microsoft System Center Configuration Manager (SCCM) integrations.
|
||||
keywords: RBAC, Threat & Vulnerability Management configuration, Threat & Vulnerability Management integrations, Microsft Intune integration with TVM, SCCM integration with TVM
|
||||
search.product: Windows 10
|
||||
@ -18,7 +18,7 @@ ms.topic: article
|
||||
---
|
||||
# Configure Threat & Vulnerability Management
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure HP ArcSight to pull Windows Defender ATP alerts
|
||||
description: Configure HP ArcSight to receive and pull alerts from Windows Defender Security Center
|
||||
title: Configure HP ArcSight to pull Microsoft Defender ATP alerts
|
||||
description: Configure HP ArcSight to receive and pull alerts from Microsoft Defender Security Center
|
||||
keywords: configure hp arcsight, security information and events management tools, arcsight
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,25 +18,25 @@ ms.topic: article
|
||||
ms.date: 12/20/2018
|
||||
---
|
||||
|
||||
# Configure HP ArcSight to pull Windows Defender ATP alerts
|
||||
# Configure HP ArcSight to pull Microsoft Defender ATP alerts
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink)
|
||||
|
||||
You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Windows Defender ATP alerts.
|
||||
You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Microsoft Defender ATP alerts.
|
||||
|
||||
## Before you begin
|
||||
Configuring the HP ArcSight Connector tool requires several configuration files for it to pull and parse alerts from your Azure Active Directory (AAD) application.
|
||||
|
||||
This section guides you in getting the necessary information to set and use the required configuration files correctly.
|
||||
|
||||
- Make sure you have enabled the SIEM integration feature from the **Settings** menu. For more information, see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md).
|
||||
- Make sure you have enabled the SIEM integration feature from the **Settings** menu. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md).
|
||||
|
||||
- Have the file you saved from enabling the SIEM integration feature ready. You'll need to get the following values:
|
||||
- OAuth 2.0 Token refresh URL
|
||||
@ -107,7 +107,7 @@ The following steps assume that you have completed all the required steps in [Be
|
||||
<td>Browse to the location of the *wdatp-connector.properties* file. The name must match the file provided in the .zip that you downloaded.</td>
|
||||
<tr>
|
||||
<td>Refresh Token</td>
|
||||
<td>You can obtain a refresh token in two ways: by generating a refresh token from the **SIEM settings** page or using the restutil tool. <br><br> For more information on generating a refresh token from the **Preferences setup** , see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md). </br> </br>**Get your refresh token using the restutil tool:** </br> a. Open a command prompt. Navigate to C:\\*folder_location*\current\bin where *folder_location* represents the location where you installed the tool. </br></br> b. Type: `arcsight restutil token -config` from the bin directory.For example: **arcsight restutil boxtoken -proxy proxy.location.hp.com:8080** A Web browser window will open. </br> </br>c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials. </br> </br>d. A refresh token is shown in the command prompt. </br></br> e. Copy and paste it into the **Refresh Token** field.
|
||||
<td>You can obtain a refresh token in two ways: by generating a refresh token from the **SIEM settings** page or using the restutil tool. <br><br> For more information on generating a refresh token from the **Preferences setup** , see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md). </br> </br>**Get your refresh token using the restutil tool:** </br> a. Open a command prompt. Navigate to C:\\*folder_location*\current\bin where *folder_location* represents the location where you installed the tool. </br></br> b. Type: `arcsight restutil token -config` from the bin directory.For example: **arcsight restutil boxtoken -proxy proxy.location.hp.com:8080** A Web browser window will open. </br> </br>c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials. </br> </br>d. A refresh token is shown in the command prompt. </br></br> e. Copy and paste it into the **Refresh Token** field.
|
||||
</td>
|
||||
</tr>
|
||||
</tr>
|
||||
@ -160,11 +160,11 @@ If the `redirect_uri` is a https URL, you'll be redirected to a URL on the local
|
||||
|
||||
9. Navigate to **Active channel set** > **New Condition** > **Device** > **Device Product**.
|
||||
|
||||
10. Set **Device Product = Windows Defender ATP**. When you've verified that events are flowing to the tool, stop the process again and go to Windows Services and start the ArcSight FlexConnector REST.
|
||||
10. Set **Device Product = Microsoft Defender ATP**. When you've verified that events are flowing to the tool, stop the process again and go to Windows Services and start the ArcSight FlexConnector REST.
|
||||
|
||||
You can now run queries in the HP ArcSight console.
|
||||
|
||||
Windows Defender ATP alerts will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name.
|
||||
Microsoft Defender ATP alerts will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name.
|
||||
|
||||
|
||||
## Troubleshooting HP ArcSight connection
|
||||
@ -187,7 +187,7 @@ Windows Defender ATP alerts will appear as discrete events, with "Microsoft” a
|
||||
> Verify that the connector is running by stopping the process again. Then start the connector again, and no browser window should appear.
|
||||
|
||||
## Related topics
|
||||
- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure conditional access in Windows Defender ATP
|
||||
title: Configure conditional access in Microsoft Defender ATP
|
||||
description:
|
||||
keywords:
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,9 +18,9 @@ ms.topic: article
|
||||
ms.date: 09/03/2018
|
||||
---
|
||||
|
||||
# Configure conditional access in Windows Defender ATP
|
||||
# Configure conditional access in Microsoft Defender ATP
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
This section guides you through all the steps you need to take to properly implement conditional access.
|
||||
|
||||
@ -38,14 +38,14 @@ You need to make sure that all your devices are enrolled in Intune. You can use
|
||||
|
||||
|
||||
|
||||
There are steps you'll need to take in Windows Defender Security Center, the Intune portal, and Azure AD portal.
|
||||
There are steps you'll need to take in Microsoft Defender Security Center, the Intune portal, and Azure AD portal.
|
||||
|
||||
> [!NOTE]
|
||||
> You'll need a Microsoft Intune environment, with Intune managed and Azure AD joined Windows 10 devices.
|
||||
|
||||
Take the following steps to enable conditional access:
|
||||
- Step 1: Turn on the Microsoft Intune connection from Windows Defender Security Center
|
||||
- Step 2: Turn on the Windows Defender ATP integration in Intune
|
||||
- Step 1: Turn on the Microsoft Intune connection from Microsoft Defender Security Center
|
||||
- Step 2: Turn on the Microsoft Defender ATP integration in Intune
|
||||
- Step 3: Create the compliance policy in Intune
|
||||
- Step 4: Assign the policy
|
||||
- Step 5: Create an Azure AD conditional access policy
|
||||
@ -57,10 +57,10 @@ Take the following steps to enable conditional access:
|
||||
3. Click **Save preferences**.
|
||||
|
||||
|
||||
### Step 2: Turn on the Windows Defender ATP integration in Intune
|
||||
### Step 2: Turn on the Microsoft Defender ATP integration in Intune
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com).
|
||||
2. Select **Device compliance** > **Windows Defender ATP**.
|
||||
3. Set **Connect Windows 10.0.15063+ devices to Windows Defender Advanced Threat Protection** to **On**.
|
||||
2. Select **Device compliance** > **Microsoft Defender ATP**.
|
||||
3. Set **Connect Windows 10.0.15063+ devices to Microsoft Defender Advanced Threat Protection** to **On**.
|
||||
4. Click **Save**.
|
||||
|
||||
|
||||
@ -80,7 +80,7 @@ Take the following steps to enable conditional access:
|
||||
|
||||
### Step 4: Assign the policy
|
||||
1. In the [Azure portal](https://portal.azure.com), select **All services**, filter on **Intune**, and select **Microsoft Intune**.
|
||||
2. Select **Device compliance** > **Policies**> select your Windows Defender ATP compliance policy.
|
||||
2. Select **Device compliance** > **Policies**> select your Microsoft Defender ATP compliance policy.
|
||||
3. Select **Assignments**.
|
||||
4. Include or exclude your Azure AD groups to assign them the policy.
|
||||
5. To deploy the policy to the groups, select **Save**. The user devices targeted by the policy are evaluated for compliance.
|
||||
@ -96,6 +96,6 @@ Take the following steps to enable conditional access:
|
||||
|
||||
6. Select **Enable policy**, and then **Create** to save your changes.
|
||||
|
||||
For more information, see [Enable Windows Defender ATP with conditional access in Intune](https://docs.microsoft.com/intune/advanced-threat-protection).
|
||||
For more information, see [Enable Microsoft Defender ATP with conditional access in Intune](https://docs.microsoft.com/intune/advanced-threat-protection).
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-belowfoldlink)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure alert notifications in Windows Defender ATP
|
||||
description: Send email notifications to specified recipients to receive new alerts based on severity with Windows Defender ATP on Windows 10 Enterprise, Pro, and Education editions.
|
||||
title: Configure alert notifications in Microsoft Defender ATP
|
||||
description: Send email notifications to specified recipients to receive new alerts based on severity with Microsoft Defender ATP on Windows 10 Enterprise, Pro, and Education editions.
|
||||
keywords: email notifications, configure alert notifications, windows defender atp notifications, windows defender atp alerts, windows 10 enterprise, windows 10 education
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -17,20 +17,20 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Configure alert notifications in Windows Defender ATP
|
||||
# Configure alert notifications in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-emailconfig-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-emailconfig-abovefoldlink)
|
||||
|
||||
You can configure Windows Defender ATP to send email notifications to specified recipients for new alerts. This feature enables you to identify a group of individuals who will immediately be informed and can act on alerts based on their severity.
|
||||
You can configure Microsoft Defender ATP to send email notifications to specified recipients for new alerts. This feature enables you to identify a group of individuals who will immediately be informed and can act on alerts based on their severity.
|
||||
|
||||
> [!NOTE]
|
||||
> Only users with 'Manage security settings' permissions can configure email notifications. If you've chosen to use basic permissions management, users with Security Administrator or Global Administrator roles can configure email notifications.
|
||||
|
||||
You can set the alert severity levels that trigger notifications. You can also add or remove recipients of the email notification. New recipients get notified about alerts encountered after they are added. For more information about alerts, see [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md).
|
||||
You can set the alert severity levels that trigger notifications. You can also add or remove recipients of the email notification. New recipients get notified about alerts encountered after they are added. For more information about alerts, see [View and organize the Alerts queue](alerts-queue.md).
|
||||
|
||||
If you're using role-based access control (RBAC), recipients will only receive notifications based on the machine groups that were configured in the notification rule.
|
||||
Users with the proper permission can only create, edit, or delete notifications that are limited to their machine group management scope.
|
||||
@ -54,9 +54,9 @@ You can create rules that determine the machines and alert severities to send em
|
||||
- **Include machine information** - Includes the machine name in the email alert body.
|
||||
|
||||
>[!NOTE]
|
||||
> This information might be processed by recipient mail servers that ar not in the geographic location you have selected for your Windows Defender ATP data.
|
||||
> This information might be processed by recipient mail servers that ar not in the geographic location you have selected for your Microsoft Defender ATP data.
|
||||
|
||||
- **Machines** - Choose whether to notify recipients for alerts on all machines (Global administrator role only) or on selected machine groups. For more information, see [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md).
|
||||
- **Machines** - Choose whether to notify recipients for alerts on all machines (Global administrator role only) or on selected machine groups. For more information, see [Create and manage machine groups](machine-groups.md).
|
||||
- **Alert severity** - Choose the alert severity level.
|
||||
|
||||
4. Click **Next**.
|
||||
@ -93,12 +93,12 @@ This section lists various issues that you may encounter when using email notifi
|
||||
|
||||
**Solution:** Make sure that the notifications are not blocked by email filters:
|
||||
|
||||
1. Check that the Windows Defender ATP email notifications are not sent to the Junk Email folder. Mark them as Not junk.
|
||||
2. Check that your email security product is not blocking the email notifications from Windows Defender ATP.
|
||||
3. Check your email application rules that might be catching and moving your Windows Defender ATP email notifications.
|
||||
1. Check that the Microsoft Defender ATP email notifications are not sent to the Junk Email folder. Mark them as Not junk.
|
||||
2. Check that your email security product is not blocking the email notifications from Microsoft Defender ATP.
|
||||
3. Check your email application rules that might be catching and moving your Microsoft Defender ATP email notifications.
|
||||
|
||||
## Related topics
|
||||
- [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable Secure Score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md)
|
||||
- [Update data retention settings](data-retention-settings.md)
|
||||
- [Enable and create Power BI reports using Microsoft Defender ATP data](powerbi-reports.md)
|
||||
- [Enable Secure Score security controls](enable-secure-score.md)
|
||||
- [Configure advanced features](advanced-features.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard Windows 10 machines using Group Policy to Windows Defender ATP
|
||||
title: Onboard Windows 10 machines using Group Policy to Microsoft Defender ATP
|
||||
description: Use Group Policy to deploy the configuration package on Windows 10 machines so that they are onboarded to the service.
|
||||
keywords: configure machines using group policy, machine management, configure Windows ATP machines, onboard Windows Defender Advanced Threat Protection machines, group policy
|
||||
keywords: configure machines using group policy, machine management, configure Windows ATP machines, onboard Microsoft Defender Advanced Threat Protection machines, group policy
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -24,19 +24,19 @@ ms.date: 04/24/2018
|
||||
|
||||
- Group Policy
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsgp-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsgp-abovefoldlink)
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later.
|
||||
|
||||
## Onboard machines using Group Policy
|
||||
1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Windows Defender Security Center](https://securitycenter.windows.com/):
|
||||
1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
@ -63,10 +63,10 @@ ms.date: 04/24/2018
|
||||
9. Click **OK** and close any open GPMC windows.
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that the machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that the machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md).
|
||||
|
||||
## Additional Windows Defender ATP configuration settings
|
||||
For each machine, you can state whether samples can be collected from the machine when a request is made through Windows Defender Security Center to submit a file for deep analysis.
|
||||
## Additional Microsoft Defender ATP configuration settings
|
||||
For each machine, you can state whether samples can be collected from the machine when a request is made through Microsoft Defender Security Center to submit a file for deep analysis.
|
||||
|
||||
You can use Group Policy (GP) to configure settings, such as settings for the sample sharing used in the deep analysis feature.
|
||||
|
||||
@ -84,7 +84,7 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa
|
||||
|
||||
4. Click **Policies**, then **Administrative templates**.
|
||||
|
||||
5. Click **Windows components** and then **Windows Defender ATP**.
|
||||
5. Click **Windows components** and then **Microsoft Defender ATP**.
|
||||
|
||||
6. Choose to enable or disable sample sharing from your machines.
|
||||
|
||||
@ -98,7 +98,7 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions.
|
||||
|
||||
1. Get the offboarding package from [Windows Defender Security Center](https://securitycenter.windows.com/):
|
||||
1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Offboarding**.
|
||||
|
||||
@ -132,7 +132,7 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
With Group Policy there isn’t an option to monitor deployment of policies on the machines. Monitoring can be done directly on the portal, or by using the different deployment tools.
|
||||
|
||||
## Monitor machines using the portal
|
||||
1. Go to [Windows Defender Security Center](https://securitycenter.windows.com/).
|
||||
1. Go to [Microsoft Defender Security Center](https://securitycenter.windows.com/).
|
||||
2. Click **Machines list**.
|
||||
3. Verify that machines are appearing.
|
||||
|
||||
@ -141,9 +141,9 @@ With Group Policy there isn’t an option to monitor deployment of policies on t
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machines](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md)
|
||||
- [Run a detection test on a newly onboarded Microsoft Defender ATP machines](run-detection-test.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard Windows 10 machines using Mobile Device Management tools
|
||||
description: Use Mobile Device Management tools to deploy the configuration package on machines so that they are onboarded to the service.
|
||||
keywords: onboard machines using mdm, machine management, onboard Windows ATP machines, onboard Windows Defender Advanced Threat Protection machines, mdm
|
||||
keywords: onboard machines using mdm, machine management, onboard Windows ATP machines, onboard Microsoft Defender Advanced Threat Protection machines, mdm
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -23,13 +23,13 @@ ms.date: 12/06/2018
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink)
|
||||
|
||||
You can use mobile device management (MDM) solutions to configure machines. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage machines.
|
||||
You can use mobile device management (MDM) solutions to configure machines. Microsoft Defender ATP supports MDMs by providing OMA-URIs to create policies to manage machines.
|
||||
|
||||
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
For more information on using Microsoft Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
|
||||
## Before you begin
|
||||
If you're using Microsoft Intune, you must have the device MDM Enrolled. Otherwise, settings will not be applied successfully.
|
||||
@ -40,7 +40,7 @@ For more information on enabling MDM with Microsoft Intune, see [Setup Windows D
|
||||
|
||||
Follow the instructions from [Intune](https://docs.microsoft.com/intune/advanced-threat-protection).
|
||||
|
||||
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
For more information on using Microsoft Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
@ -49,7 +49,7 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre
|
||||
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that a machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that a machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md).
|
||||
|
||||
## Offboard and monitor machines using Mobile Device Management tools
|
||||
For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
@ -57,7 +57,7 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions.
|
||||
|
||||
1. Get the offboarding package from [Windows Defender Security Center](https://securitycenter.windows.com/):
|
||||
1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Offboarding**.
|
||||
|
||||
@ -79,9 +79,9 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md)
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md)
|
||||
- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard non-Windows machines to the Windows Defender ATP service
|
||||
description: Configure non-Winodws machines so that they can send sensor data to the Windows Defender ATP service.
|
||||
keywords: onboard non-Windows machines, macos, linux, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines
|
||||
title: Onboard non-Windows machines to the Microsoft Defender ATP service
|
||||
description: Configure non-Winodws machines so that they can send sensor data to the Microsoft Defender ATP service.
|
||||
keywords: onboard non-Windows machines, macos, linux, machine management, configure Windows ATP machines, configure Microsoft Defender Advanced Threat Protection machines
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -22,15 +22,15 @@ ms.topic: article
|
||||
|
||||
- macOS
|
||||
- Linux
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-nonwindows-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-nonwindows-abovefoldlink)
|
||||
|
||||
|
||||
|
||||
Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Windows Defender Security Center and better protect your organization's network.
|
||||
Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Microsoft Defender Security Center and better protect your organization's network.
|
||||
|
||||
You'll need to know the exact Linux distros and macOS versions that are compatible with Windows Defender ATP for the integration to work.
|
||||
You'll need to know the exact Linux distros and macOS versions that are compatible with Microsoft Defender ATP for the integration to work.
|
||||
|
||||
|
||||
|
||||
@ -38,7 +38,7 @@ You'll need to know the exact Linux distros and macOS versions that are compatib
|
||||
You'll need to take the following steps to onboard non-Windows machines:
|
||||
1. Select your preferred method of onboarding:
|
||||
|
||||
- For macOS devices, you can choose to onboard through Windows Defender ATP or through a third-party solution. For more information, see [Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac).
|
||||
- For macOS devices, you can choose to onboard through Microsoft Defender ATP or through a third-party solution. For more information, see [Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac).
|
||||
- For other non-Windows devices choose **Onboard non-Windows machines through third-party integration**.
|
||||
|
||||
1. In the navigation pane, select **Interoperability** > **Partners**. Make sure the third-party solution is listed.
|
||||
@ -54,7 +54,7 @@ You'll need to take the following steps to onboard non-Windows machines:
|
||||
|
||||
## Offboard non-Windows machines
|
||||
|
||||
1. Follow the third-party's documentation to disconnect the third-party solution from Windows Defender ATP.
|
||||
1. Follow the third-party's documentation to disconnect the third-party solution from Microsoft Defender ATP.
|
||||
|
||||
2. Remove permissions for the third-party solution in your Azure AD tenant.
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com).
|
||||
@ -64,7 +64,7 @@ You'll need to take the following steps to onboard non-Windows machines:
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshooting Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines](configure-endpoints.md)
|
||||
- [Onboard servers](configure-server-endpoints.md)
|
||||
- [Configure proxy and Internet connectivity settings](configure-proxy-internet.md)
|
||||
- [Troubleshooting Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard Windows 10 machines using System Center Configuration Manager
|
||||
description: Use System Center Configuration Manager to deploy the configuration package on machines so that they are onboarded to the service.
|
||||
keywords: onboard machines using sccm, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines, sccm
|
||||
keywords: onboard machines using sccm, machine management, configure Windows ATP machines, configure Microsoft Defender Advanced Threat Protection machines, sccm
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -23,16 +23,16 @@ ms.date: 12/11/2018
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- System Center 2012 Configuration Manager or later versions
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointssccm-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointssccm-abovefoldlink)
|
||||
|
||||
<span id="sccm1606"/>
|
||||
## Onboard Windows 10 machines using System Center Configuration Manager (current branch) version 1606
|
||||
System Center Configuration Manager (SCCM) (current branch) version 1606, has UI integrated support for configuring and managing Windows Defender ATP on machines. For more information, see [Support for Windows Defender Advanced Threat Protection service](https://go.microsoft.com/fwlink/p/?linkid=823682).
|
||||
System Center Configuration Manager (SCCM) (current branch) version 1606, has UI integrated support for configuring and managing Microsoft Defender ATP on machines. For more information, see [Support for Microsoft Defender Advanced Threat Protection service](https://go.microsoft.com/fwlink/p/?linkid=823682).
|
||||
|
||||
>[!NOTE]
|
||||
> If you’re using SCCM client version 1606 with server version 1610 or above, you must upgrade the client version to match the server version.
|
||||
@ -49,7 +49,7 @@ You can use existing System Center Configuration Manager functionality to create
|
||||
### Onboard machines using System Center Configuration Manager
|
||||
|
||||
|
||||
1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Windows Defender Security Center](https://securitycenter.windows.com/):
|
||||
1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
@ -66,13 +66,13 @@ You can use existing System Center Configuration Manager functionality to create
|
||||
a. Choose a predefined device collection to deploy the package to.
|
||||
|
||||
> [!NOTE]
|
||||
> Windows Defender ATP doesn't support onboarding during the [Out-Of-Box Experience (OOBE)](https://answers.microsoft.com/en-us/windows/wiki/windows_10/how-to-complete-the-windows-10-out-of-box/47e3f943-f000-45e3-8c5c-9d85a1a0cf87) phase. Make sure users complete OOBE after running Windows installation or upgrading.
|
||||
> Microsoft Defender ATP doesn't support onboarding during the [Out-Of-Box Experience (OOBE)](https://answers.microsoft.com/en-us/windows/wiki/windows_10/how-to-complete-the-windows-10-out-of-box/47e3f943-f000-45e3-8c5c-9d85a1a0cf87) phase. Make sure users complete OOBE after running Windows installation or upgrading.
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md).
|
||||
|
||||
### Configure sample collection settings
|
||||
For each machine, you can set a configuration value to state whether samples can be collected from the machine when a request is made through Windows Defender Security Center to submit a file for deep analysis.
|
||||
For each machine, you can set a configuration value to state whether samples can be collected from the machine when a request is made through Microsoft Defender Security Center to submit a file for deep analysis.
|
||||
|
||||
You can set a compliance rule for configuration item in System Center Configuration Manager to change the sample share setting on a machine.
|
||||
This rule should be a *remediating* compliance rule configuration item that sets the value of a registry key on targeted machines to make sure they’re complaint.
|
||||
@ -103,7 +103,7 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions.
|
||||
|
||||
1. Get the offboarding package from [Windows Defender Security Center](https://securitycenter.windows.com/):
|
||||
1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Offboarding**.
|
||||
|
||||
@ -128,7 +128,7 @@ Monitoring with SCCM consists of two parts:
|
||||
|
||||
1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the machines in your network.
|
||||
|
||||
2. Checking that the machines are compliant with the Windows Defender ATP service (this ensures the machine can complete the onboarding process and can continue to report data to the service).
|
||||
2. Checking that the machines are compliant with the Microsoft Defender ATP service (this ensures the machine can complete the onboarding process and can continue to report data to the service).
|
||||
|
||||
**To confirm the configuration package has been correctly deployed:**
|
||||
|
||||
@ -140,11 +140,11 @@ Monitoring with SCCM consists of two parts:
|
||||
|
||||
4. Review the status indicators under **Completion Statistics** and **Content Status**.
|
||||
|
||||
If there are failed deployments (machines with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the machines. For more information see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
|
||||
If there are failed deployments (machines with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the machines. For more information see, [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md).
|
||||
|
||||
|
||||
|
||||
**Check that the machines are compliant with the Windows Defender ATP service:**<br>
|
||||
**Check that the machines are compliant with the Microsoft Defender ATP service:**<br>
|
||||
You can set a compliance rule for configuration item in System Center Configuration Manager to monitor your deployment.
|
||||
|
||||
This rule should be a *non-remediating* compliance rule configuration item that monitors the value of a registry key on targeted machines.
|
||||
@ -158,9 +158,9 @@ Value: “1”
|
||||
For more information about System Center Configuration Manager Compliance see [Get started with compliance settings in System Center Configuration Manager](https://docs.microsoft.com/sccm/compliance/get-started/get-started-with-compliance-settings).
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md)
|
||||
- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard Windows 10 machines using a local script
|
||||
description: Use a local script to deploy the configuration package on machines so that they are onboarded to the service.
|
||||
keywords: configure machines using a local script, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines
|
||||
keywords: configure machines using a local script, machine management, configure Windows ATP machines, configure Microsoft Defender Advanced Threat Protection machines
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -22,20 +22,20 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink)
|
||||
|
||||
You can also manually onboard individual machines to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all machines in your network.
|
||||
You can also manually onboard individual machines to Microsoft Defender ATP. You might want to do this first when testing the service before you commit to onboarding all machines in your network.
|
||||
|
||||
> [!NOTE]
|
||||
> The script has been optimized to be used on a limited number of machines (1-10 machines). To deploy to scale, use other deployment options. For more information on using other deployment options, see [Onboard Window 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
|
||||
> The script has been optimized to be used on a limited number of machines (1-10 machines). To deploy to scale, use other deployment options. For more information on using other deployment options, see [Onboard Window 10 machines](configure-endpoints.md).
|
||||
|
||||
## Onboard machines
|
||||
1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Windows Defender Security Center](https://securitycenter.windows.com/):
|
||||
1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
@ -60,14 +60,14 @@ You can also manually onboard individual machines to Windows Defender ATP. You m
|
||||
|
||||
5. Press the **Enter** key or click **OK**.
|
||||
|
||||
For information on how you can manually validate that the machine is compliant and correctly reports sensor data see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
|
||||
For information on how you can manually validate that the machine is compliant and correctly reports sensor data see, [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md).
|
||||
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md).
|
||||
|
||||
## Configure sample collection settings
|
||||
For each machine, you can set a configuration value to state whether samples can be collected from the machine when a request is made through Windows Defender Security Center to submit a file for deep analysis.
|
||||
For each machine, you can set a configuration value to state whether samples can be collected from the machine when a request is made through Microsoft Defender Security Center to submit a file for deep analysis.
|
||||
|
||||
You can manually configure the sample sharing setting on the machine by using *regedit* or creating and running a *.reg* file.
|
||||
|
||||
@ -93,7 +93,7 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions.
|
||||
|
||||
1. Get the offboarding package from [Windows Defender Security Center](https://securitycenter.windows.com/):
|
||||
1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Offboarding**.
|
||||
|
||||
@ -122,12 +122,12 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
|
||||
|
||||
## Monitor machine configuration
|
||||
You can follow the different verification steps in the [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) to verify that the script completed successfully and the agent is running.
|
||||
You can follow the different verification steps in the [Troubleshoot onboarding issues](troubleshoot-onboarding.md) to verify that the script completed successfully and the agent is running.
|
||||
|
||||
Monitoring can also be done directly on the portal, or by using the different deployment tools.
|
||||
|
||||
### Monitor machines using the portal
|
||||
1. Go to Windows Defender Security Center.
|
||||
1. Go to Microsoft Defender Security Center.
|
||||
|
||||
2. Click **Machines list**.
|
||||
|
||||
@ -135,9 +135,9 @@ Monitoring can also be done directly on the portal, or by using the different de
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md)
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md)
|
||||
- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
description: Deploy the configuration package on virtual desktop infrastructure (VDI) machine so that they are onboarded to Windows Defender ATP the service.
|
||||
keywords: configure virtual desktop infrastructure (VDI) machine, vdi, machine management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
|
||||
description: Deploy the configuration package on virtual desktop infrastructure (VDI) machine so that they are onboarded to Microsoft Defender ATP the service.
|
||||
keywords: configure virtual desktop infrastructure (VDI) machine, vdi, machine management, configure Windows ATP endpoints, configure Microsoft Defender Advanced Threat Protection endpoints
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -25,15 +25,15 @@ ms.date: 04/24/2018
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configvdi-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configvdi-abovefoldlink)
|
||||
|
||||
## Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
|
||||
Windows Defender ATP supports non-persistent VDI session onboarding. There might be associated challenges when onboarding VDIs. The following are typical challenges for this scenario:
|
||||
Microsoft Defender ATP supports non-persistent VDI session onboarding. There might be associated challenges when onboarding VDIs. The following are typical challenges for this scenario:
|
||||
|
||||
|
||||
- Instant early onboarding of a short living session
|
||||
- A session should be onboarded to Windows Defender ATP prior to the actual provisioning.
|
||||
- A session should be onboarded to Microsoft Defender ATP prior to the actual provisioning.
|
||||
|
||||
- Machine name persistence
|
||||
- The machine names are typically reused for new sessions. One may ask to have them as a single machine entry while others may prefer to have multiple entries per machine name.
|
||||
@ -41,9 +41,9 @@ Windows Defender ATP supports non-persistent VDI session onboarding. There might
|
||||
You can onboard VDI machines using a single entry or multiple entries for each machine. The following steps will guide you through onboarding VDI machines and will highlight steps for single and multiple entries.
|
||||
|
||||
>[!WARNING]
|
||||
> For environments where there are low resource configurations, the VDI boot proceedure might slow the Windows Defender ATP sensor onboarding.
|
||||
> For environments where there are low resource configurations, the VDI boot proceedure might slow the Microsoft Defender ATP sensor onboarding.
|
||||
|
||||
1. Open the VDI configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Windows Defender Security Center](https://securitycenter.windows.com/):
|
||||
1. Open the VDI configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
@ -83,18 +83,18 @@ You can onboard VDI machines using a single entry or multiple entries for each m
|
||||
|
||||
d. Logon to machine with another user.
|
||||
|
||||
e. **For single entry for each machine**: Check only one entry in Windows Defender Security Center.<br>
|
||||
**For multiple entries for each machine**: Check multiple entries in Windows Defender Security Center.
|
||||
e. **For single entry for each machine**: Check only one entry in Microsoft Defender Security Center.<br>
|
||||
**For multiple entries for each machine**: Check multiple entries in Microsoft Defender Security Center.
|
||||
|
||||
7. Click **Machines list** on the Navigation pane.
|
||||
|
||||
8. Use the search function by entering the machine name and select **Machine** as search type.
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md)
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md)
|
||||
|
||||
|
||||
@ -0,0 +1,49 @@
|
||||
---
|
||||
title: Onboard Windows 10 machines on Microsoft Defender ATP
|
||||
description: Onboard Windows 10 machines so that they can send sensor data to the Microsoft Defender ATP sensor
|
||||
keywords: Onboard Windows 10 machines, group policy, system center configuration manager, mobile device management, local script, gp, sccm, mdm, intune
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 07/12/2018
|
||||
---
|
||||
|
||||
# Onboard Windows 10 machines
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
Machines in your organization must be configured so that the Microsoft Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the machines in your organization.
|
||||
|
||||
The following deployment tools and methods are supported:
|
||||
|
||||
- Group Policy
|
||||
- System Center Configuration Manager
|
||||
- Mobile Device Management (including Microsoft Intune)
|
||||
- Local script
|
||||
|
||||
## In this section
|
||||
Topic | Description
|
||||
:---|:---
|
||||
[Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) | Use Group Policy to deploy the configuration package on machines.
|
||||
[Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm.md) | You can use either use System Center Configuration Manager (current branch) version 1606 or System Center Configuration Manager(current branch) version 1602 or earlier to deploy the configuration package on machines.
|
||||
[Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md) | Use Mobile Device Management tools or Microsoft Intune to deploy the configuration package on machine.
|
||||
[Onboard Windows 10 machines using a local script](configure-endpoints-script.md) | Learn how to use the local script to deploy the configuration package on endpoints.
|
||||
[Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md) | Learn how to use the configuration package to configure VDI machines.
|
||||
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpoints-belowfoldlink)
|
||||
@ -19,20 +19,22 @@ ms.date: 02/28/2019
|
||||
---
|
||||
|
||||
# Configure and manage Microsoft Threat Experts capabilities
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Before you begin
|
||||
To experience the full Microsoft Threat Experts targeted attack notification capability in Windows Defender ATP, and preview the experts-on-demand capability, you need to have a valid Premier customer service and support account. Premier charges will not be incurred during for the capability in preview, but for the generally available capability, there will be charges.
|
||||
|
||||
You also need to ensure that you have Windows Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up.
|
||||
To experience the full Microsoft Threat Experts targeted attack notification capability in Microsoft Defender ATP, and preview the experts-on-demand capability, you need to have a valid Premier customer service and support account. Premier charges will not be incurred during for the capability in preview, but for the generally available capability, there will be charges.
|
||||
|
||||
You also need to ensure that you have Microsoft Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up.
|
||||
|
||||
## Register to Microsoft Threat Experts managed threat hunting service
|
||||
If you're already a Windows Defender ATP customer, you can apply through the Windows Defender ATP portal.
|
||||
## Register to Microsoft Threat Experts preview
|
||||
|
||||
If you're already a Microsoft Defender ATP customer, you can apply through the Microsoft Defender ATP portal.
|
||||
|
||||
1. From the navigation pane, go to **Settings > General > Advanced features > Microsoft Threat Experts**.
|
||||
|
||||
@ -48,29 +50,32 @@ If you're already a Windows Defender ATP customer, you can apply through the Win
|
||||
6. From the navigation pane, go to **Settings** > **General** > **Advanced features** to turn the **Threat Experts** toggle on. Click **Save preferences**.
|
||||
|
||||
## Receive targeted attack notification from Microsoft Threat Experts
|
||||
|
||||
You can receive targeted attack notification from Microsoft Threat Experts through the following:
|
||||
- The Windows Defender ATP portal's **Alerts** dashboard
|
||||
|
||||
- The Microsoft Defender ATP portal's **Alerts** dashboard
|
||||
- Your email, if you choose to configure it
|
||||
|
||||
To receive targeted attack notifications through email, you need to create an email notification rule.
|
||||
|
||||
### Create an email notification rule
|
||||
You can create rules to send email notifications for notification recipients. See [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md) to create, edit, delete, or troubleshoot email notification, for details.
|
||||
|
||||
You can create rules to send email notifications for notification recipients. See [Configure alert notifications](configure-email-notifications.md) to create, edit, delete, or troubleshoot email notification, for details.
|
||||
|
||||
## View the targeted attack notification
|
||||
|
||||
You'll start receiving targeted attack notification from Microsoft Threat Experts in your email after you have configured your system to receive email notification.
|
||||
|
||||
1. Click the link in the email to go to the corresponding alert context in the dashboard tagged with **Threat experts**.
|
||||
|
||||
2. From the dashboard, select the same alert topic that you got from the email, to view the details.
|
||||
|
||||
|
||||
## Ask a Microsoft threat expert about suspicious cybersecurity activities in your organization
|
||||
|
||||
>[!NOTE]
|
||||
>The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved.
|
||||
|
||||
You can partner with Microsoft Threat Experts who can be engaged directly from within the Windows Defender Security Center for timely and accurate response. Experts provide insights needed to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard.
|
||||
You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights needed to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard.
|
||||
|
||||
1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or machine is in view before raising an inquiry.
|
||||
2. From the upper right-hand menu, click **?**, then select **Ask a threat expert**.
|
||||
@ -85,13 +90,13 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w
|
||||
|
||||
**Step 2: Open a support ticket**
|
||||
>[!NOTE]
|
||||
>To experience the full Microsoft Threat Experts preview capability in Windows Defender ATP, you need to have a Premier customer service and support account. However, you will not be charged for the Experts-on-demand service during the preview.
|
||||
>To experience the full Microsoft Threat Experts preview capability in Microsoft Defender ATP, you need to have a Premier customer service and support account. However, you will not be charged for the Experts-on-demand service during the preview.
|
||||
|
||||
a. In the **New support request** customer support page, select the following from the dropdown menu and then click **Next**: <br>
|
||||
|
||||
**Select the product family**: **Security**<br>
|
||||
**Select a product**: **Microsoft Threat Experts**<br>
|
||||
**Select a category that best describes the issue**: **Windows Defender ATP**<br>
|
||||
**Select a category that best describes the issue**: **Microsoft Defender ATP**<br>
|
||||
**Select a problem that best describes the issue**: Choose according to your inquiry category<br>
|
||||
|
||||
b. Fill out the fields with the necessary information about the issue and use the auto-generated ID when you open a Customer Services and Support (CSS) ticket. Then, click **Next**. <br>
|
||||
@ -105,21 +110,26 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w
|
||||
f. Review the summary of your support request, and update if necessary. Make sure that you read and understand the **Microsoft Services Agreement** and **Privacy Statement**. Then, click **Submit**. You will see the confirmation page indicating the response time and your support request number. <br>
|
||||
|
||||
## Sample questions to ask Microsoft Threat Experts
|
||||
|
||||
**Alert information**
|
||||
|
||||
- We see a new type of alert for a living-off-the-land binary: [AlertID]. Can you tell us something more about this alert and how we can investigate further?
|
||||
- We’ve observed two similar attacks which try to execute malicious PowerShell scripts but generate different alerts. One is "Suspicious Powershell command line" and the other is "A malicious file was detected based on indication provided by O365". What is the difference?
|
||||
- I receive an odd alert today for abnormal number of failed logins from a high profile user’s device. I cannot find any further evidence around these sign-in attempts. How can Windows Defender see these attempts? What type of sign-ins are being monitored?
|
||||
- Can you give more context or insights about this alert: “Suspicious behavior by a system utility was observed”.
|
||||
|
||||
**Possible machine compromise**
|
||||
|
||||
- Can you please help answer why we see “Unknown process observed?” This is seen quite frequently on many machines and we would appreciate input on whether this is related to malicious activity.
|
||||
- Can you help validate a possible compromise on the following system on [date] with similar behaviors as the previous [malware name] malware detection on the same system in [month]?
|
||||
|
||||
**Threat intelligence details**
|
||||
|
||||
- This morning, we detected a phishing email that delivered a malicious Word document to a user. This caused a series of suspicious events which triggered multiple Windows Defender alerts for [malware name] malware. Do you have any information on this malware? If yes, can you please send me a link?
|
||||
- I recently saw a [social media reference e.g. Twitter or blog] post about a threat that is targeting my industry. Can you help me understand what protection Windows Defender ATP provides against this threat actor?
|
||||
- I recently saw a [social media reference e.g. Twitter or blog] post about a threat that is targeting my industry. Can you help me understand what protection Microsoft Defender ATP provides against this threat actor?
|
||||
|
||||
**Microsoft Threat Experts’ alert communications**
|
||||
|
||||
- Can your incident response team help us address the targeted attack notification that we got?
|
||||
- I received this targeted attack notification from Microsoft Threat Experts. We don’t have our own incident response team. What can we do now, and how can we contain the incident?
|
||||
- I received a targeted attack notification from Microsoft Threat Experts. What data can you provide to us that we can pass on to our incident response team?
|
||||
@ -130,11 +140,12 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w
|
||||
## Scenario
|
||||
|
||||
### Receive a progress report about your managed hunting inquiry
|
||||
|
||||
Response from Microsoft Threat Experts varies according to your inquiry. They will email a progress report to you regarding the Ask a threat expert inquiry that you've submitted, within two days, to communicate the investigation status from the following categories:
|
||||
|
||||
- More information is needed to continue with the investigation
|
||||
- A file or several file samples are needed to determine the technical context
|
||||
- Investigation requires more time
|
||||
- Initial information was enough to conclude the investigation
|
||||
|
||||
It is crucial to respond in a timely manner to keep the investigation moving. See the Premier customer service and support service level agreement for details.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure managed security service provider support
|
||||
description: Take the necessary steps to configure the MSSP integration with Windows Defender ATP
|
||||
description: Take the necessary steps to configure the MSSP integration with Microsoft Defender ATP
|
||||
keywords: managed security service provider, mssp, configure, integration
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -21,9 +21,9 @@ ms.date: 09/03/2018
|
||||
# Configure managed security service provider integration
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -35,19 +35,19 @@ You'll need to take the following configuration steps to enable the managed secu
|
||||
> - MSSP customers: Organizations that engage the services of MSSPs.
|
||||
|
||||
The integration will allow MSSPs to take the following actions:
|
||||
- Get access to MSSP customer's Windows Defender Security Center portal
|
||||
- Get access to MSSP customer's Microsoft Defender Security Center portal
|
||||
- Get email notifications, and
|
||||
- Fetch alerts through security information and event management (SIEM) tools
|
||||
|
||||
Before MSSPs can take these actions, the MSSP customer will need to grant access to their Windows Defender ATP tenant so that the MSSP can access the portal.
|
||||
Before MSSPs can take these actions, the MSSP customer will need to grant access to their Microsoft Defender ATP tenant so that the MSSP can access the portal.
|
||||
|
||||
Typically, MSSP customers take the initial configuration steps to grant MSSPs access to their Windows Defender Security Central tenant. After access is granted, other configuration steps can be done by either the MSSP customer or the MSSP.
|
||||
|
||||
|
||||
In general, the following configuration steps need to be taken:
|
||||
|
||||
- **Grant the MSSP access to Windows Defender Security Center** <br>
|
||||
This action needs to be done by the MSSP customer. It grants the MSSP access to the MSSP customer's Windows Defender ATP tenant.
|
||||
- **Grant the MSSP access to Microsoft Defender Security Center** <br>
|
||||
This action needs to be done by the MSSP customer. It grants the MSSP access to the MSSP customer's Microsoft Defender ATP tenant.
|
||||
|
||||
- **Configure alert notifications sent to MSSPs** <br>
|
||||
This action can be taken by either the MSSP customer or MSSP. This lets the MSSPs know what alerts they need to address for the MSSP customer.
|
||||
@ -65,27 +65,27 @@ This action is taken by the MSSP. It allows MSSPs to fetch alerts using APIs.
|
||||
> These set of steps are directed towards the MSSP customer. <br>
|
||||
> Access to the portal can only be done by the MSSP customer.
|
||||
|
||||
As a MSSP customer, you'll need to take the following configuration steps to grant the MSSP access to Windows Defender Security Center.
|
||||
As a MSSP customer, you'll need to take the following configuration steps to grant the MSSP access to Microsoft Defender Security Center.
|
||||
|
||||
Authentication and authorization of the MSSP user is built on top of Azure Active Directory (Azure AD) B2B functionality.
|
||||
|
||||
You'll need to take the following 2 steps:
|
||||
- Add MSSP user to your tenant as a guest user
|
||||
- Grant MSSP user access to Windows Defender Security Center
|
||||
- Grant MSSP user access to Microsoft Defender Security Center
|
||||
|
||||
### Add MSSP user to your tenant as a guest user
|
||||
Add a user who is a member of the MSSP tenant to your tenant as a guest user.
|
||||
|
||||
To grant portal access to the MSSP, you must add the MSSP user to your Azure AD as a guest user. For more information, see [Add Azure Active Directory B2B collaboration users in the Azure portal](https://docs.microsoft.com/azure/active-directory/b2b/add-users-administrator).
|
||||
|
||||
### Grant MSSP user access to Windows Defender Security Center
|
||||
Grant the guest user access and permissions to your Windows Defender Security Center tenant.
|
||||
### Grant MSSP user access to Microsoft Defender Security Center
|
||||
Grant the guest user access and permissions to your Microsoft Defender Security Center tenant.
|
||||
|
||||
Granting access to guest user is done the same way as granting access to a user who is a member of your tenant.
|
||||
|
||||
If you're using basic permissions to access the portal, the guest user must be assigned a Security Administrator role in **your** tenant. For more information, see [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md).
|
||||
If you're using basic permissions to access the portal, the guest user must be assigned a Security Administrator role in **your** tenant. For more information, see [Use basic permissions to access the portal](basic-permissions.md).
|
||||
|
||||
If you're using role-based access control (RBAC), the guest user must be to added to the appropriate group or groups in **your** tenant. Fore more information on RBAC in Windows Defender ATP, see [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md).
|
||||
If you're using role-based access control (RBAC), the guest user must be to added to the appropriate group or groups in **your** tenant. Fore more information on RBAC in Microsoft Defender ATP, see [Manage portal access using RBAC](rbac.md).
|
||||
|
||||
>[!NOTE]
|
||||
>There is no difference between the Member user and Guest user roles from RBAC perspective.
|
||||
@ -94,12 +94,12 @@ It is recommended that groups are created for MSSPs to make authorization access
|
||||
|
||||
As a MSSP customer, you can always remove or modify the permissions granted to the MSSP by updating the Azure AD user groups.
|
||||
|
||||
## Access the Windows Defender Security Center MSSP customer portal
|
||||
## Access the Microsoft Defender Security Center MSSP customer portal
|
||||
|
||||
>[!NOTE]
|
||||
>These set of steps are directed towards the MSSP.
|
||||
|
||||
By default, MSSP customers access their Windows Defender Security Center tenant through the following URL: `https://securitycenter.windows.com`.
|
||||
By default, MSSP customers access their Microsoft Defender Security Center tenant through the following URL: `https://securitycenter.windows.com`.
|
||||
|
||||
MSSPs however, will need to use a tenant-specific URL in the following format: `https://securitycenter.windows.com?tid=customer_tenant_id` to access the MSSP customer portal.
|
||||
|
||||
@ -123,7 +123,7 @@ Use the following steps to obtain the MSSP customer tenant ID and then use the I
|
||||
|
||||
After access the portal is granted, alert notification rules can to be created so that emails are sent to MSSPs when alerts associated with the tenant are created and set conditions are met.
|
||||
|
||||
For more information, see [Create rules for alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md#create-rules-for-alert-notifications).
|
||||
For more information, see [Create rules for alert notifications](configure-email-notifications.md#create-rules-for-alert-notifications).
|
||||
|
||||
These check boxes must be checked:
|
||||
- **Include organization name** - The customer name will be added to email notifications
|
||||
@ -142,12 +142,12 @@ Step 1: Create a third-party application
|
||||
|
||||
Step 2: Get access and refresh tokens from your customer's tenant
|
||||
|
||||
Step 3: Whitelist your application on Windows Defender Security Center
|
||||
Step 3: Whitelist your application on Microsoft Defender Security Center
|
||||
|
||||
|
||||
|
||||
### Step 1: Create an application in Azure Active Directory (Azure AD)
|
||||
You'll need to create an application and grant it permissions to fetch alerts from your customer's Windows Defender ATP tenant.
|
||||
You'll need to create an application and grant it permissions to fetch alerts from your customer's Microsoft Defender ATP tenant.
|
||||
|
||||
1. Sign in to the [Azure AD portal](https://aad.portal.azure.com/).
|
||||
|
||||
@ -257,8 +257,8 @@ After providing your credentials, you'll need to grant consent to the applicatio
|
||||
|
||||
8. In the PowerShell window, you'll receive an access token and a refresh token. Save the refresh token to configure your SIEM connector.
|
||||
|
||||
### Step 3: Whitelist your application on Windows Defender Security Center
|
||||
You'll need to whitelist the application you created in Windows Defender Security Center.
|
||||
### Step 3: Whitelist your application on Microsoft Defender Security Center
|
||||
You'll need to whitelist the application you created in Microsoft Defender Security Center.
|
||||
|
||||
You'll need to have **Manage portal system settings** permission to whitelist the application. Otherwise, you'll need to request your customer to whitelist the application for you.
|
||||
|
||||
@ -272,17 +272,17 @@ You'll need to have **Manage portal system settings** permission to whitelist th
|
||||
|
||||
5. Click **Authorize application**.
|
||||
|
||||
You can now download the relevant configuration file for your SIEM and connect to the Windows Defender ATP API. For more information see, [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md).
|
||||
You can now download the relevant configuration file for your SIEM and connect to the Microsoft Defender ATP API. For more information see, [Pull alerts to your SIEM tools](configure-siem.md).
|
||||
|
||||
- In the ArcSight configuration file / Splunk Authentication Properties file you will have to write your application key manually by settings the secret value.
|
||||
- Instead of acquiring a refresh token in the portal, use the script from the previous step to acquire a refresh token (or acquire it by other means).
|
||||
|
||||
## Fetch alerts from MSSP customer's tenant using APIs
|
||||
For information on how to fetch alerts using REST API, see [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md).
|
||||
For information on how to fetch alerts using REST API, see [Pull alerts using REST API](pull-alerts-using-rest-api.md).
|
||||
|
||||
## Related topics
|
||||
- [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Use basic permissions to access the portal](basic-permissions.md)
|
||||
- [Manage portal access using RBAC](rbac.md)
|
||||
- [Pull alerts to your SIEM tools](configure-siem.md)
|
||||
- [Pull alerts using REST API](pull-alerts-using-rest-api.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure machine proxy and Internet connection settings
|
||||
description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service.
|
||||
description: Configure the Microsoft Defender ATP proxy and internet settings to enable communication with the cloud service.
|
||||
keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, netsh, winhttp, proxy server
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -21,15 +21,15 @@ ms.topic: article
|
||||
# Configure machine proxy and Internet connectivity settings
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink)
|
||||
|
||||
The Windows Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
The Microsoft Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Microsoft Defender ATP service.
|
||||
|
||||
The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service.
|
||||
The embedded Microsoft Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Microsoft Defender ATP cloud service.
|
||||
|
||||
The WinHTTP configuration setting is independent of the Windows Internet (WinINet) internet browsing proxy settings and can only discover a proxy server by using the following discovery methods:
|
||||
|
||||
@ -38,7 +38,7 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe
|
||||
- Web Proxy Auto-discovery Protocol (WPAD)
|
||||
|
||||
> [!NOTE]
|
||||
> If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Windows Defender ATP URL exclusions in the proxy, see [Enable access to Windows Defender ATP service URLs in the proxy server](#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server).
|
||||
> If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Microsoft Defender ATP URL exclusions in the proxy, see [Enable access to Microsoft Defender ATP service URLs in the proxy server](#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
||||
|
||||
|
||||
- Manual static proxy configuration:
|
||||
@ -46,7 +46,7 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe
|
||||
- WinHTTP configured using netsh command – Suitable only for desktops in a stable topology (for example: a desktop in a corporate network behind the same proxy)
|
||||
|
||||
## Configure the proxy server manually using a registry-based static proxy
|
||||
Configure a registry-based static proxy to allow only Windows Defender ATP sensor to report diagnostic data and communicate with Windows Defender ATP services if a computer is not be permitted to connect to the Internet.
|
||||
Configure a registry-based static proxy to allow only Microsoft Defender ATP sensor to report diagnostic data and communicate with Microsoft Defender ATP services if a computer is not be permitted to connect to the Internet.
|
||||
|
||||
The static proxy is configurable through Group Policy (GP). The group policy can be found under:
|
||||
- Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Authenticated Proxy usage for the Connected User Experience and Telemetry Service
|
||||
@ -93,8 +93,8 @@ netsh winhttp reset proxy
|
||||
```
|
||||
See [Netsh Command Syntax, Contexts, and Formatting](https://docs.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts) to learn more.
|
||||
|
||||
## Enable access to Windows Defender ATP service URLs in the proxy server
|
||||
If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are not blocked by default. Do not disable security monitoring or inspection of these URLs, but allow them as you would other internet traffic. They permit communication with Windows Defender ATP service in port 80 and 443:
|
||||
## Enable access to Microsoft Defender ATP service URLs in the proxy server
|
||||
If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are not blocked by default. Do not disable security monitoring or inspection of these URLs, but allow them as you would other internet traffic. They permit communication with Microsoft Defender ATP service in port 80 and 443:
|
||||
|
||||
>[!NOTE]
|
||||
> URLs that include v20 in them are only needed if you have Windows 10, version 1803 or later machines. For example, ```us-v20.events.data.microsoft.com``` is only needed if the machine is on Windows 10, version 1803 or later.
|
||||
@ -108,12 +108,12 @@ United States | ```us.vortex-win.data.microsoft.com```<br> ```us-v20.events.data
|
||||
|
||||
|
||||
|
||||
If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs.
|
||||
If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs.
|
||||
|
||||
## Windows Defender ATP service backend IP range
|
||||
## Microsoft Defender ATP service backend IP range
|
||||
If you network devices don't support the URLs white-listed in the prior section, you can use the following information.
|
||||
|
||||
Windows Defender ATP is built on Azure cloud, deployed in the following regions:
|
||||
Microsoft Defender ATP is built on Azure cloud, deployed in the following regions:
|
||||
|
||||
- \+\<Region Name="uswestcentral">
|
||||
- \+\<Region Name="useast2">
|
||||
@ -130,11 +130,11 @@ You can find the Azure IP range on [Microsoft Azure Datacenter IP Ranges](https:
|
||||
> As a cloud-based solution, the IP range can change. It's recommended you move to DNS resolving setting.
|
||||
|
||||
|
||||
## Verify client connectivity to Windows Defender ATP service URLs
|
||||
## Verify client connectivity to Microsoft Defender ATP service URLs
|
||||
|
||||
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs.
|
||||
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Microsoft Defender ATP service URLs.
|
||||
|
||||
1. Download the [connectivity verification tool](https://go.microsoft.com/fwlink/p/?linkid=823683) to the PC where Windows Defender ATP sensor is running on.
|
||||
1. Download the [connectivity verification tool](https://go.microsoft.com/fwlink/p/?linkid=823683) to the PC where Microsoft Defender ATP sensor is running on.
|
||||
|
||||
2. Extract the contents of WDATPConnectivityAnalyzer on the machine.
|
||||
|
||||
@ -157,7 +157,7 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover
|
||||
5. Extract the *WDATPConnectivityAnalyzerResult.zip* file created by tool in the folder used in the *HardDrivePath*.
|
||||
|
||||
6. Open *WDATPConnectivityAnalyzer.txt* and verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. <br><br>
|
||||
The tool checks the connectivity of Windows Defender ATP service URLs that Windows Defender ATP client is configured to interact with. It then prints the results into the *WDATPConnectivityAnalyzer.txt* file for each URL that can potentially be used to communicate with the Windows Defender ATP services. For example:
|
||||
The tool checks the connectivity of Microsoft Defender ATP service URLs that Microsoft Defender ATP client is configured to interact with. It then prints the results into the *WDATPConnectivityAnalyzer.txt* file for each URL that can potentially be used to communicate with the Microsoft Defender ATP services. For example:
|
||||
```text
|
||||
Testing URL : https://xxx.microsoft.com/xxx
|
||||
1 - Default proxy: Succeeded (200)
|
||||
@ -167,13 +167,13 @@ The tool checks the connectivity of Windows Defender ATP service URLs that Windo
|
||||
5 - Command line proxy: Doesn't exist
|
||||
```
|
||||
|
||||
If at least one of the connectivity options returns a (200) status, then the Windows Defender ATP client can communicate with the tested URL properly using this connectivity method. <br><br>
|
||||
If at least one of the connectivity options returns a (200) status, then the Microsoft Defender ATP client can communicate with the tested URL properly using this connectivity method. <br><br>
|
||||
|
||||
However, if the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Windows Defender ATP service URLs in the proxy server](#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server). The URLs you'll use will depend on the region selected during the onboarding procedure.
|
||||
However, if the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Microsoft Defender ATP service URLs in the proxy server](#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). The URLs you'll use will depend on the region selected during the onboarding procedure.
|
||||
|
||||
> [!NOTE]
|
||||
> When the TelemetryProxyServer is set, in Registry or via Group Policy, Windows Defender ATP will fall back to direct if it can't access the defined proxy.
|
||||
> When the TelemetryProxyServer is set, in Registry or via Group Policy, Microsoft Defender ATP will fall back to direct if it can't access the defined proxy.
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines](configure-endpoints.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard servers to the Windows Defender ATP service
|
||||
description: Onboard servers so that they can send sensor data to the Windows Defender ATP sensor.
|
||||
keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, machine management, configure Windows ATP servers, onboard Windows Defender Advanced Threat Protection servers
|
||||
title: Onboard servers to the Microsoft Defender ATP service
|
||||
description: Onboard servers so that they can send sensor data to the Microsoft Defender ATP sensor.
|
||||
keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, machine management, configure Windows ATP servers, onboard Microsoft Defender Advanced Threat Protection servers
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -16,7 +16,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Onboard servers to the Windows Defender ATP service
|
||||
# Onboard servers to the Microsoft Defender ATP service
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -24,14 +24,14 @@ ms.topic: article
|
||||
- Windows Server 2016
|
||||
- Windows Server, version 1803
|
||||
- Windows Server, 2019
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
|
||||
|
||||
Windows Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console.
|
||||
Microsoft Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Microsoft Defender Security Center console.
|
||||
|
||||
The service supports the onboarding of the following servers:
|
||||
- Windows Server 2012 R2
|
||||
@ -40,14 +40,14 @@ The service supports the onboarding of the following servers:
|
||||
- Windows Server 2019
|
||||
|
||||
|
||||
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Windows Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
|
||||
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
|
||||
|
||||
## Windows Server 2012 R2 and Windows Server 2016
|
||||
|
||||
There are two options to onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP:
|
||||
There are two options to onboard Windows Server 2012 R2 and Windows Server 2016 to Microsoft Defender ATP:
|
||||
|
||||
- **Option 1**: Onboard through Azure Security Center
|
||||
- **Option 2**: Onboard through Windows Defender Security Center
|
||||
- **Option 2**: Onboard through Microsoft Defender Security Center
|
||||
|
||||
### Option 1: Onboard servers through Azure Security Center
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
@ -56,35 +56,35 @@ There are two options to onboard Windows Server 2012 R2 and Windows Server 2016
|
||||
|
||||
3. Click **Onboard Servers in Azure Security Center**.
|
||||
|
||||
4. Follow the onboarding instructions in [Windows Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
|
||||
### Option 2: Onboard servers through Windows Defender Security Center
|
||||
You'll need to tak the following steps if you choose to onboard servers through Windows Defender Security Center.
|
||||
### Option 2: Onboard servers through Microsoft Defender Security Center
|
||||
You'll need to tak the following steps if you choose to onboard servers through Microsoft Defender Security Center.
|
||||
|
||||
- For Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients.
|
||||
|
||||
>[!NOTE]
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
- Turn on server monitoring from Windows Defender Security Center.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through Multi Homing support. Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
|
||||
- Turn on server monitoring from Microsoft Defender Security Center.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multi Homing support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
|
||||
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md).
|
||||
|
||||
### Configure and update System Center Endpoint Protection clients
|
||||
>[!IMPORTANT]
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
Windows Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
Microsoft Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
|
||||
The following steps are required to enable this integration:
|
||||
- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie)
|
||||
- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting
|
||||
|
||||
|
||||
### Turn on Server monitoring from the Windows Defender Security Center portal
|
||||
### Turn on Server monitoring from the Microsoft Defender Security Center portal
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
|
||||
@ -93,7 +93,7 @@ The following steps are required to enable this integration:
|
||||
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
|
||||
<span id="server-mma"/>
|
||||
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP
|
||||
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender ATP
|
||||
|
||||
1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603).
|
||||
|
||||
@ -110,7 +110,7 @@ Once completed, you should see onboarded servers in the portal within an hour.
|
||||
### Configure server proxy and Internet connectivity settings
|
||||
|
||||
- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the [OMS Gateway](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway).
|
||||
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service:
|
||||
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Microsoft Defender ATP service:
|
||||
|
||||
Agent Resource | Ports
|
||||
:---|:---
|
||||
@ -136,9 +136,9 @@ Supported tools include:
|
||||
- System Center Configuration Manager 2012 / 2012 R2 1511 / 1602
|
||||
- VDI onboarding scripts for non-persistent machines
|
||||
|
||||
For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). Support for Windows Server, version 1803 and Windows 2019 provides deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
For more information, see [Onboard Windows 10 machines](configure-endpoints.md). Support for Windows Server, version 1803 and Windows 2019 provides deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
|
||||
1. Configure Windows Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
|
||||
1. Configure Microsoft Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints.md).
|
||||
|
||||
2. If you’re running a third party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings and verify it was configured correctly:
|
||||
|
||||
@ -163,23 +163,23 @@ Supported tools include:
|
||||
|
||||
|
||||
## Integration with Azure Security Center
|
||||
Windows Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Windows Defender ATP to provide improved threat detection for Windows Servers.
|
||||
Microsoft Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
The following capabilities are included in this integration:
|
||||
- Automated onboarding - Windows Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
|
||||
- Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
|
||||
|
||||
>[!NOTE]
|
||||
> Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016.
|
||||
|
||||
- Servers monitored by Azure Security Center will also be available in Windows Defender ATP - Azure Security Center seamlessly connects to the Windows Defender ATP tenant, providing a single view across clients and servers. In addition, Windows Defender ATP alerts will be available in the Azure Security Center console.
|
||||
- Server investigation - Azure Security Center customers can access Windows Defender Security Center to perform detailed investigation to uncover the scope of a potential breach
|
||||
- Servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console.
|
||||
- Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach
|
||||
|
||||
>[!IMPORTANT]
|
||||
>- When you use Azure Security Center to monitor servers, a Windows Defender ATP tenant is automatically created. The Windows Defender ATP data is stored in Europe by default.
|
||||
>- If you use Windows Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
|
||||
>- When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default.
|
||||
>- If you use Microsoft Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
|
||||
|
||||
|
||||
|
||||
@ -188,26 +188,26 @@ You can offboard Windows Server, version 1803 and Windows 2019 in the same metho
|
||||
|
||||
For other server versions, you have two options to offboard servers from the service:
|
||||
- Uninstall the MMA agent
|
||||
- Remove the Windows Defender ATP workspace configuration
|
||||
- Remove the Microsoft Defender ATP workspace configuration
|
||||
|
||||
>[!NOTE]
|
||||
>Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
|
||||
### Uninstall servers by uinstalling the MMA agent
|
||||
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Windows Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Windows Defender ATP.
|
||||
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Microsoft Defender ATP.
|
||||
For more information, see [To disable an agent](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).
|
||||
|
||||
### Remove the Windows Defender ATP workspace configuration
|
||||
### Remove the Microsoft Defender ATP workspace configuration
|
||||
To offboard the server, you can use either of the following methods:
|
||||
|
||||
- Remove the Windows Defender ATP workspace configuration from the MMA agent
|
||||
- Remove the Microsoft Defender ATP workspace configuration from the MMA agent
|
||||
- Run a PowerShell command to remove the configuration
|
||||
|
||||
#### Remove the Windows Defender ATP workspace configuration from the MMA agent
|
||||
#### Remove the Microsoft Defender ATP workspace configuration from the MMA agent
|
||||
|
||||
1. In the **Microsoft Monitoring Agent Properties**, select the **Azure Log Analytics (OMS)** tab.
|
||||
|
||||
2. Select the Windows Defender ATP workspace, and click **Remove**.
|
||||
2. Select the Microsoft Defender ATP workspace, and click **Remove**.
|
||||
|
||||
|
||||
|
||||
@ -232,8 +232,8 @@ To offboard the server, you can use either of the following methods:
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshooting Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines](configure-endpoints.md)
|
||||
- [Onboard non-Windows machines](configure-endpoints-non-windows.md)
|
||||
- [Configure proxy and Internet connectivity settings](configure-proxy-internet.md)
|
||||
- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md)
|
||||
- [Troubleshooting Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md)
|
||||
@ -0,0 +1,63 @@
|
||||
---
|
||||
title: Pull alerts to your SIEM tools from Microsoft Defender Advanced Threat Protection
|
||||
description: Learn how to use REST API and configure supported security information and events management tools to receive and pull alerts.
|
||||
keywords: configure siem, security information and events management tools, splunk, arcsight, custom indicators, rest api, alert definitions, indicators of compromise
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/16/2017
|
||||
---
|
||||
|
||||
# Pull alerts to your SIEM tools
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
||||
|
||||
## Pull alerts using security information and events management (SIEM) tools
|
||||
Microsoft Defender ATP supports (SIEM) tools to pull alerts. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
|
||||
|
||||
|
||||
Microsoft Defender ATP currently supports the following SIEM tools:
|
||||
|
||||
- Splunk
|
||||
- HP ArcSight
|
||||
|
||||
To use either of these supported SIEM tools you'll need to:
|
||||
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
- Configure the supported SIEM tool:
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)
|
||||
- [Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)
|
||||
|
||||
For more information on the list of fields exposed in the alerts API see, [Microsoft Defender ATP alert API fields](api-portal-mapping.md).
|
||||
|
||||
|
||||
## Pull Microsoft Defender ATP alerts using REST API
|
||||
Microsoft Defender ATP supports the OAuth 2.0 protocol to pull alerts using REST API.
|
||||
|
||||
For more information, see [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md).
|
||||
|
||||
|
||||
## In this section
|
||||
|
||||
Topic | Description
|
||||
:---|:---
|
||||
[Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)| Learn about enabling the SIEM integration feature in the **Settings** page in the portal so that you can use and generate the required information to configure supported SIEM tools.
|
||||
[Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)| Learn about installing the REST API Modular Input app and other configuration settings to enable Splunk to pull Microsoft Defender ATP alerts.
|
||||
[Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)| Learn about installing the HP ArcSight REST FlexConnector package and the files you need to configure ArcSight to pull Microsoft Defender ATP alerts.
|
||||
[Microsoft Defender ATP alert API fields](api-portal-mapping.md) | Understand what data fields are exposed as part of the alerts API and how they map to Microsoft Defender Security Center.
|
||||
[Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) | Use the Client credentials OAuth 2.0 flow to pull alerts from Microsoft Defender ATP using REST API.
|
||||
[Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) | Address issues you might encounter when using the SIEM integration feature.
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure Splunk to pull Windows Defender ATP alerts
|
||||
description: Configure Splunk to receive and pull alerts from Windows Defender Security Center.
|
||||
title: Configure Splunk to pull Microsoft Defender ATP alerts
|
||||
description: Configure Splunk to receive and pull alerts from Microsoft Defender Security Center.
|
||||
keywords: configure splunk, security information and events management tools, splunk
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,23 +18,23 @@ ms.topic: article
|
||||
ms.date: 10/16/2017
|
||||
---
|
||||
|
||||
# Configure Splunk to pull Windows Defender ATP alerts
|
||||
# Configure Splunk to pull Microsoft Defender ATP alerts
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresplunk-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresplunk-abovefoldlink)
|
||||
|
||||
You'll need to configure Splunk so that it can pull Windows Defender ATP alerts.
|
||||
You'll need to configure Splunk so that it can pull Microsoft Defender ATP alerts.
|
||||
|
||||
## Before you begin
|
||||
|
||||
- Install the [REST API Modular Input app](https://splunkbase.splunk.com/app/1546/) in Splunk.
|
||||
- Make sure you have enabled the **SIEM integration** feature from the **Settings** menu. For more information, see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- Make sure you have enabled the **SIEM integration** feature from the **Settings** menu. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
|
||||
- Have the details file you saved from enabling the **SIEM integration** feature ready. You'll need to get the following values:
|
||||
- OAuth 2 Token refresh URL
|
||||
@ -107,7 +107,7 @@ You'll need to configure Splunk so that it can pull Windows Defender ATP alerts.
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Polling Interval</td>
|
||||
<td>Number of seconds that Splunk will ping the Windows Defender ATP machine. Accepted values are in seconds.</td>
|
||||
<td>Number of seconds that Splunk will ping the Microsoft Defender ATP machine. Accepted values are in seconds.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Set sourcetype</td>
|
||||
@ -146,8 +146,8 @@ Use the solution explorer to view alerts in Splunk.
|
||||
>```source="rest://windows atp alerts" | spath | dedup _raw | table *```
|
||||
|
||||
## Related topics
|
||||
- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
- [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)
|
||||
- [Microsoft Defender ATP alert API fields](api-portal-mapping.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||
@ -14,18 +14,19 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
|
||||
---
|
||||
|
||||
# Create alert from event API
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Enables using event data, as obtained from the [Advanced Hunting](run-advanced-query-api.md) for creating a new alert entity.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
@ -34,10 +35,11 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'
|
||||
|
||||
>[!Note]
|
||||
> When obtaining a token using user credentials:
|
||||
>- The user needs to have at least the following role permission: 'Alerts investigation' (See [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) for more information)
|
||||
>- The user needs to have access to the machine associated with the alert, based on machine group settings (See [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) for more information)
|
||||
>- The user needs to have at least the following role permission: 'Alerts investigation' (See [Create and manage roles](user-roles.md) for more information)
|
||||
>- The user needs to have access to the machine associated with the alert, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information)
|
||||
|
||||
## HTTP request
|
||||
|
||||
```
|
||||
POST https://api.securitycenter.windows.com/api/alerts/CreateAlertByReference
|
||||
```
|
||||
@ -50,6 +52,7 @@ Authorization | String | Bearer {token}. **Required**.
|
||||
Content-Type | String | application/json. **Required**.
|
||||
|
||||
## Request body
|
||||
|
||||
In the request body, supply the following values (all are required):
|
||||
|
||||
Property | Type | Description
|
||||
@ -63,10 +66,9 @@ eventTime | DateTime(UTC) | The time of the event, as obtained from the advanced
|
||||
reportId | String | The reportId, as obtained from the advanced query. **Required**.
|
||||
category| String | Category of the alert. The property values are: 'None', 'SuspiciousActivity', 'Malware', 'CredentialTheft', 'Exploit', 'WebExploit', 'DocumentExploit', 'PrivilegeEscalation', 'Persistence', 'RemoteAccessTool', 'CommandAndControl', 'SuspiciousNetworkTraffic', 'Ransomware', 'MalwareDownload', 'Reconnaissance', 'WebFingerprinting', 'Weaponization', 'Delivery', 'SocialEngineering', 'CredentialStealing', 'Installation', 'Backdoor', 'Trojan', 'TrojanDownloader', 'LateralMovement', 'ExplorationEnumeration', 'NetworkPropagation', 'Exfiltration', 'NotApplicable', 'EnterprisePolicy' and 'General'.
|
||||
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK, and a new [alert](alerts-windows-defender-advanced-threat-protection-new.md) object in the response body. If event with the specified properties (_reportId_, _eventTime_ and _machineId_) was not found - 404 Not Found.
|
||||
|
||||
If successful, this method returns 200 OK, and a new [alert](alerts.md) object in the response body. If event with the specified properties (_reportId_, _eventTime_ and _machineId_) was not found - 404 Not Found.
|
||||
|
||||
## Example
|
||||
|
||||
@ -74,7 +76,7 @@ If successful, this method returns 200 OK, and a new [alert](alerts-windows-defe
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
[!include[Improve request performance](improverequestperformance-new.md)]
|
||||
[!include[Improve request performance](improve-request-performance.md)]
|
||||
|
||||
```
|
||||
POST https://api.securitycenter.windows.com/api/alerts/CreateAlertByReference
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user