mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 07:17:24 +00:00
Merge branch 'master' into av-relnotes
This commit is contained in:
Denise Vangel-MSFT
commit
fcffbaebf1
@ -43,6 +43,10 @@ SurfaceHub
|
||||
------------AutoWakeScreen
|
||||
------------CurrentBackgroundPath
|
||||
------------MeetingInfoOption
|
||||
--------Whiteboard
|
||||
------------SharingDisabled
|
||||
------------SigninDisabled
|
||||
------------TelemeteryDisabled
|
||||
--------WirelessProjection
|
||||
------------PINRequired
|
||||
------------Enabled
|
||||
@ -305,6 +309,24 @@ SurfaceHub
|
||||
|
||||
<p style="margin-left: 20px">The data type is integer. Supported operation is Get and Replace.
|
||||
|
||||
<a href="" id="inboxapps-whiteboard"></a>**InBoxApps/Whiteboard**
|
||||
<p style="margin-left: 20px">Node for the Whiteboard app settings.
|
||||
|
||||
<a href="" id="inboxapps-whiteboard-sharingdisabled"></a>**InBoxApps/Whiteboard/SharingDisabled**
|
||||
<p style="margin-left: 20px">Invitations to collaborate from the Whiteboard app are not allowed.
|
||||
|
||||
<p style="margin-left: 20px">The data type is boolean. Supported operation is Get and Replace.
|
||||
|
||||
<a href="" id="inboxapps-whiteboard-signindisabled"></a>**InBoxApps/Whiteboard/SigninDisabled**
|
||||
<p style="margin-left: 20px">Sign-ins from the Whiteboard app are not allowed.
|
||||
|
||||
<p style="margin-left: 20px">The data type is boolean. Supported operation is Get and Replace.
|
||||
|
||||
<a href="" id="inboxapps-whiteboard-telemetrydisabled"></a>**InBoxApps/Whiteboard/TelemeteryDisabled**
|
||||
<p style="margin-left: 20px">Telemetry collection from the Whiteboard app is not allowed.
|
||||
|
||||
<p style="margin-left: 20px">The data type is boolean. Supported operation is Get and Replace.
|
||||
|
||||
<a href="" id="inboxapps-wirelessprojection"></a>**InBoxApps/WirelessProjection**
|
||||
<p style="margin-left: 20px">Node for the wireless projector app settings.
|
||||
|
||||
|
||||
@ -62,6 +62,9 @@ To enforce processing of the group policy, you can run ```gpupdate /force```.
|
||||
> [!NOTE]
|
||||
> It will enable VBS and Secure Boot and you can do it with or without UEFI Lock. If you will need to disable Credential Guard remotely, enable it without UEFI lock.
|
||||
|
||||
> [!TIP]
|
||||
> You can also configure Credential Guard by using an account protection profile in endpoint security. See [Account protection policy settings for endpoint security in Intune](https://docs.microsoft.com/mem/intune/protect/endpoint-security-account-protection-profile-settings).
|
||||
|
||||
### Enable Windows Defender Credential Guard by using the registry
|
||||
|
||||
If you don't use Group Policy, you can enable Windows Defender Credential Guard by using the registry. Windows Defender Credential Guard uses virtualization-based security features which have to be enabled first on some operating systems.
|
||||
@ -117,17 +120,17 @@ You can do this by using either the Control Panel or the Deployment Image Servic
|
||||
|
||||
2. Enable virtualization-based security:
|
||||
|
||||
- Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard.
|
||||
1. Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard.
|
||||
|
||||
- Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it.
|
||||
1. Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it.
|
||||
|
||||
- Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**.
|
||||
1. Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**.
|
||||
|
||||
3. Enable Windows Defender Credential Guard:
|
||||
|
||||
- Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA.
|
||||
1. Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA.
|
||||
|
||||
- Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it.
|
||||
1. Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it.
|
||||
|
||||
4. Close Registry Editor.
|
||||
|
||||
@ -164,7 +167,8 @@ You can view System Information to check that Windows Defender Credential Guard
|
||||
|
||||
Here's an example:
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
You can also check that Windows Defender Credential Guard is running by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
|
||||
@ -258,7 +262,7 @@ To disable Windows Defender Credential Guard, you can use the following set of p
|
||||
> [!NOTE]
|
||||
> The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Windows Defender Credential Guard and virtualization-based security, run the following bcdedit commands after turning off all virtualization-based security Group Policy and registry settings:
|
||||
>
|
||||
>```
|
||||
>```console
|
||||
>bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
|
||||
>bcdedit /set vsmlaunchtype off
|
||||
>```
|
||||
@ -274,7 +278,7 @@ For more info on virtualization-based security and HVCI, see [Enable virtualizat
|
||||
|
||||
You can also disable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
|
||||
```console
|
||||
```powershell
|
||||
DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot
|
||||
```
|
||||
|
||||
|
||||
@ -7,8 +7,8 @@
|
||||
#### [Upgrading](bitlocker\bitlocker-upgrading-faq.md)
|
||||
#### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.yml)
|
||||
#### [Key management](bitlocker\bitlocker-key-management-faq.md)
|
||||
#### [BitLocker To Go](bitlocker\bitlocker-to-go-faq.md)
|
||||
#### [Active Directory Domain Services](bitlocker\bitlocker-and-adds-faq.md)
|
||||
#### [BitLocker To Go](bitlocker\bitlocker-to-go-faq.yml)
|
||||
#### [Active Directory Domain Services](bitlocker\bitlocker-and-adds-faq.yml)
|
||||
#### [Security](bitlocker\bitlocker-security-faq.md)
|
||||
#### [BitLocker Network Unlock](bitlocker\bitlocker-network-unlock-faq.md)
|
||||
#### [General](bitlocker\bitlocker-using-with-other-programs-faq.md)
|
||||
|
||||
@ -1,73 +0,0 @@
|
||||
---
|
||||
title: BitLocker and Active Directory Domain Services (AD DS) FAQ (Windows 10)
|
||||
description: Learn more about how BitLocker and Active Directory Domain Services (AD DS) can work together to keep devices secure.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker and Active Directory Domain Services (AD DS) FAQ
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
|
||||
## What type of information is stored in AD DS?
|
||||
|
||||
Stored information | Description
|
||||
-------------------|------------
|
||||
Hash of the TPM owner password | Beginning with Windows 10, the password hash is not stored in AD DS by default. The password hash can be stored only if the TPM is owned and the ownership was taken by using components of Windows 8.1 or earlier, such as the BitLocker Setup Wizard or the TPM snap-in.
|
||||
BitLocker recovery password | The recovery password allows you to unlock and access the drive after a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md).
|
||||
BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`.
|
||||
|
||||
## What if BitLocker is enabled on a computer before the computer has joined the domain?
|
||||
|
||||
If BitLocker is enabled on a drive before Group Policy has been applied to enforce a backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS.
|
||||
|
||||
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
|
||||
The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The `manage-bde` command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt:
|
||||
|
||||
```PowerShell
|
||||
$BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive
|
||||
$RecoveryProtector = $BitLocker.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }
|
||||
|
||||
Backup-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID
|
||||
BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy).
|
||||
|
||||
## Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup?
|
||||
|
||||
Yes, an event log entry that indicates the success or failure of an Active Directory backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it is also possible that the log entry could be spoofed.
|
||||
|
||||
Ultimately, determining whether a legitimate backup exists in AD DS requires querying AD DS with domain administrator credentials by using the BitLocker password viewer tool.
|
||||
|
||||
## If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password?
|
||||
|
||||
No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object.
|
||||
|
||||
## What happens if the backup initially fails? Will BitLocker retry it?
|
||||
|
||||
If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS.
|
||||
|
||||
When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization.
|
||||
|
||||
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
|
||||
When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored.
|
||||
|
||||
@ -0,0 +1,83 @@
|
||||
### YamlMime:FAQ
|
||||
metadata:
|
||||
title: BitLocker and Active Directory Domain Services (AD DS) FAQ (Windows 10)
|
||||
description: Learn more about how BitLocker and Active Directory Domain Services (AD DS) can work together to keep devices secure.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
|
||||
title: BitLocker and Active Directory Domain Services (AD DS) FAQ
|
||||
summary: |
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
|
||||
|
||||
sections:
|
||||
- name: Ignored
|
||||
questions:
|
||||
- question: |
|
||||
What type of information is stored in AD DS?
|
||||
answer: |
|
||||
Stored information | Description
|
||||
-------------------|------------
|
||||
Hash of the TPM owner password | Beginning with Windows 10, the password hash is not stored in AD DS by default. The password hash can be stored only if the TPM is owned and the ownership was taken by using components of Windows 8.1 or earlier, such as the BitLocker Setup Wizard or the TPM snap-in.
|
||||
BitLocker recovery password | The recovery password allows you to unlock and access the drive after a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md).
|
||||
BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`.
|
||||
|
||||
- question: |
|
||||
What if BitLocker is enabled on a computer before the computer has joined the domain?
|
||||
answer: |
|
||||
If BitLocker is enabled on a drive before Group Policy has been applied to enforce a backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS.
|
||||
|
||||
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
|
||||
The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The `manage-bde` command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt:
|
||||
|
||||
```PowerShell
|
||||
$BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive
|
||||
$RecoveryProtector = $BitLocker.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }
|
||||
|
||||
Backup-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID
|
||||
BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy).
|
||||
|
||||
- question: |
|
||||
Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup?
|
||||
answer: |
|
||||
Yes, an event log entry that indicates the success or failure of an Active Directory backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it is also possible that the log entry could be spoofed.
|
||||
|
||||
Ultimately, determining whether a legitimate backup exists in AD DS requires querying AD DS with domain administrator credentials by using the BitLocker password viewer tool.
|
||||
|
||||
- question: |
|
||||
If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password?
|
||||
answer: |
|
||||
No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object.
|
||||
|
||||
- question: |
|
||||
What happens if the backup initially fails? Will BitLocker retry it?
|
||||
answer: |
|
||||
If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS.
|
||||
|
||||
When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization.
|
||||
|
||||
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
|
||||
When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain-) to capture the information after connectivity is restored.
|
||||
|
||||
|
||||
@ -29,8 +29,8 @@ This topic links to frequently asked questions about BitLocker. BitLocker is a d
|
||||
- [Upgrading](bitlocker-upgrading-faq.md)
|
||||
- [Deployment and administration](bitlocker-deployment-and-administration-faq.yml)
|
||||
- [Key management](bitlocker-key-management-faq.md)
|
||||
- [BitLocker To Go](bitlocker-to-go-faq.md)
|
||||
- [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.md)
|
||||
- [BitLocker To Go](bitlocker-to-go-faq.yml)
|
||||
- [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.yml)
|
||||
- [Security](bitlocker-security-faq.md)
|
||||
- [BitLocker Network Unlock](bitlocker-network-unlock-faq.md)
|
||||
- [Using BitLocker with other programs and general questions](bitlocker-using-with-other-programs-faq.md)
|
||||
@ -45,4 +45,4 @@ This topic links to frequently asked questions about BitLocker. BitLocker is a d
|
||||
- [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md)
|
||||
- [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md)
|
||||
- [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md)
|
||||
- [BitLocker Cmdlets in Windows PowerShell](/powershell/module/bitlocker/index?view=win10-ps)
|
||||
- [BitLocker Cmdlets in Windows PowerShell](/powershell/module/bitlocker/index?view=win10-ps&preserve-view=true)
|
||||
@ -1,37 +0,0 @@
|
||||
---
|
||||
title: BitLocker To Go FAQ (Windows 10)
|
||||
description: "Learn more about BitLocker To Go: BitLocker drive encryption for removable drives."
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 07/10/2018
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker To Go FAQ
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
## What is BitLocker To Go?
|
||||
|
||||
BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of:
|
||||
|
||||
- USB flash drives
|
||||
- SD cards
|
||||
- External hard disk drives
|
||||
- Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system.
|
||||
|
||||
Drive partitioning must meet the [BitLocker Drive Encryption Partitioning Requirements](/windows-hardware/manufacture/desktop/bitlocker-drive-encryption#bitlocker-drive-encryption-partitioning-requirements).
|
||||
|
||||
As with BitLocker, you can open drives that are encrypted by BitLocker To Go by using a password or smart card on another computer. In Control Panel, use **BitLocker Drive Encryption**.
|
||||
@ -0,0 +1,41 @@
|
||||
### YamlMime:FAQ
|
||||
metadata:
|
||||
title: BitLocker To Go FAQ (Windows 10)
|
||||
description: "Learn more about BitLocker To Go"
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 07/10/2018
|
||||
ms.custom: bitlocker
|
||||
|
||||
title: BitLocker To Go FAQ
|
||||
summary: |
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
|
||||
sections:
|
||||
- name: Ignored
|
||||
questions:
|
||||
- question: What is BitLocker To Go?
|
||||
answer: |
|
||||
BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of:
|
||||
|
||||
- USB flash drives
|
||||
- SD cards
|
||||
- External hard disk drives
|
||||
- Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system.
|
||||
|
||||
Drive partitioning must meet the [BitLocker Drive Encryption Partitioning Requirements](/windows-hardware/manufacture/desktop/bitlocker-drive-encryption#bitlocker-drive-encryption-partitioning-requirements).
|
||||
|
||||
As with BitLocker, you can open drives that are encrypted by BitLocker To Go by using a password or smart card on another computer. In Control Panel, use **BitLocker Drive Encryption**.
|
||||
@ -31,8 +31,9 @@ Windows 10 prompts you for a BitLocker recovery password. However, you did not c
|
||||
|
||||
The BitLocker and Active Directory Domain Services (AD DS) FAQ addresses situations that may produce this symptom, and provides information about how to resolve the issue:
|
||||
|
||||
- [What if BitLocker is enabled on a computer before the computer has joined the domain?](./bitlocker-and-adds-faq.md#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain)
|
||||
- [What happens if the backup initially fails? Will BitLocker retry the backup?](./bitlocker-and-adds-faq.md)
|
||||
- [What if BitLocker is enabled on a computer before the computer has joined the domain?](./bitlocker-and-adds-faq.yml#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain-)
|
||||
|
||||
- [What happens if the backup initially fails? Will BitLocker retry the backup?](./bitlocker-and-adds-faq.yml)
|
||||
|
||||
## The recovery password for a laptop was not backed up, and the laptop is locked
|
||||
|
||||
@ -201,9 +202,9 @@ To reset the PCR settings on the TPM, follow these steps:
|
||||
You can avoid this scenario when you install updates to system firmware or TPM firmware by temporarily suspending BitLocker before you apply such updates.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> TPM and UEFI firmware updates may require multiple restarts while they install. To keep BitLocker suspended during this process, you must use [Suspend-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/suspend-bitlocker?view=winserver2012r2-ps) and set the **Reboot Count** parameter to either of the following values:
|
||||
> TPM and UEFI firmware updates may require multiple restarts while they install. To keep BitLocker suspended during this process, you must use [Suspend-BitLocker](/powershell/module/bitlocker/suspend-bitlocker?view=winserver2012r2-ps&preserve-view=true) and set the **Reboot Count** parameter to either of the following values:
|
||||
> - **2** or greater: This value sets the number of times the device can restart before BitLocker Device Encryption resumes.
|
||||
> - **0**: This value suspends BitLocker Drive Encryption indefinitely, until you use [Resume-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/resume-bitlocker?view=winserver2012r2-ps) or another mechanism to resume protection.
|
||||
> - **0**: This value suspends BitLocker Drive Encryption indefinitely, until you use [Resume-BitLocker](/powershell/module/bitlocker/resume-bitlocker?view=winserver2012r2-ps&preserve-view=true) or another mechanism to resume protection.
|
||||
|
||||
To suspend BitLocker while you install TPM or UEFI firmware updates:
|
||||
|
||||
|
||||
@ -21,6 +21,7 @@ ms.date: 04/19/2017
|
||||
**Applies to**
|
||||
- Windows 10, version 1511
|
||||
- Windows 10, version 1507
|
||||
- TPM 1.2
|
||||
|
||||
This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system.
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ ms.technology: mde
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
<img src="images/event-4624.png" alt="Event 4624 illustration" width="438" height="668" hspace="10" align="left" />
|
||||
<img src="images/event-4624.png" alt="Event 4624 illustration" width="438" height="668" hspace="10" />
|
||||
|
||||
***Subcategory:*** [Audit Logon](audit-logon.md)
|
||||
|
||||
@ -29,14 +29,16 @@ ms.technology: mde
|
||||
|
||||
This event generates when a logon session is created (on destination machine). It generates on the computer that was accessed, where the session was created.
|
||||
|
||||
> **Note** For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
> [!NOTE]
|
||||
> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
|
||||
<br clear="all">
|
||||
|
||||
***Event XML:***
|
||||
```xml
|
||||
<?xml version="1.0"?>
|
||||
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
||||
<Event
|
||||
xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
||||
<System>
|
||||
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}"/>
|
||||
<EventID>4624</EventID>
|
||||
@ -95,37 +97,38 @@ This event generates when a logon session is created (on destination machine). I
|
||||
|
||||
- 1 - Windows Server 2012, Windows 8.
|
||||
|
||||
- Added “Impersonation Level” field.
|
||||
- Added "Impersonation Level" field.
|
||||
|
||||
- 2 – Windows 10.
|
||||
|
||||
- Added “Logon Information:” section.
|
||||
- Added "Logon Information:" section.
|
||||
|
||||
- **Logon Type** moved to “Logon Information:” section.
|
||||
- **Logon Type** moved to "Logon Information:" section.
|
||||
|
||||
- Added “Restricted Admin Mode” field.
|
||||
- Added "Restricted Admin Mode" field.
|
||||
|
||||
- Added “Virtual Account” field.
|
||||
- Added "Virtual Account" field.
|
||||
|
||||
- Added “Elevated Token” field.
|
||||
- Added "Elevated Token" field.
|
||||
|
||||
- Added “Linked Logon ID” field.
|
||||
- Added "Linked Logon ID" field.
|
||||
|
||||
- Added “Network Account Name” field.
|
||||
- Added "Network Account Name" field.
|
||||
|
||||
- Added “Network Account Domain” field.
|
||||
- Added "Network Account Domain" field.
|
||||
|
||||
***Field Descriptions:***
|
||||
|
||||
**Subject:**
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
- **Security ID** [Type = SID]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
> [!NOTE]
|
||||
> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about successful logon.
|
||||
- **Account Name** [Type = UnicodeString]**:** the name of the account that reported information about successful logon.
|
||||
|
||||
- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following:
|
||||
- **Account Domain** [Type = UnicodeString]**:** subject’s domain or computer name. Formats vary, and include the following:
|
||||
|
||||
- Domain NETBIOS name example: CONTOSO
|
||||
|
||||
@ -133,15 +136,15 @@ This event generates when a logon session is created (on destination machine). I
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY".
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81".
|
||||
|
||||
- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4672](event-4672.md)(S): Special privileges assigned to new logon.”
|
||||
- **Logon ID** [Type = HexInt64]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, "[4672](event-4672.md)(S): Special privileges assigned to new logon."
|
||||
|
||||
**Logon Information** \[Version 2\]**:**
|
||||
**Logon Information** [Version 2]**:**
|
||||
|
||||
- **Logon Type** \[Version 0, 1, 2\] \[Type = UInt32\]**:** the type of logon which was performed. The table below contains the list of possible values for this field.
|
||||
- **Logon Type** [Version 0, 1, 2] [Type = UInt32]**:** the type of logon which was performed. The table below contains the list of possible values for this field.
|
||||
|
||||
## Logon types and descriptions
|
||||
|
||||
@ -160,17 +163,17 @@ This event generates when a logon session is created (on destination machine). I
|
||||
| `12` | `CachedRemoteInteractive` | Same as RemoteInteractive. This is used for internal auditing. |
|
||||
| `13` | `CachedUnlock` | Workstation logon. |
|
||||
|
||||
- **Restricted Admin Mode** \[Version 2\] \[Type = UnicodeString\]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10.
|
||||
- **Restricted Admin Mode** [Version 2] [Type = UnicodeString]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10.
|
||||
|
||||
Reference: <https://blogs.technet.com/b/kfalde/archive/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2.aspx>.
|
||||
|
||||
If not a **RemoteInteractive** logon, then this will be "-" string.
|
||||
|
||||
- **Virtual Account** \[Version 2\] \[Type = UnicodeString\]**:** a “Yes” or “No” flag, which indicates if the account is a virtual account (e.g., "[Managed Service Account](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd560633(v=ws.10))"), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using "NetworkService".
|
||||
- **Virtual Account** [Version 2] [Type = UnicodeString]**:** a "Yes" or "No" flag, which indicates if the account is a virtual account (e.g., "[Managed Service Account](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd560633(v=ws.10))"), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using "NetworkService".
|
||||
|
||||
- **Elevated Token** \[Version 2\] \[Type = UnicodeString\]**:** a “Yes” or “No” flag. If “Yes” then the session this event represents is elevated and has administrator privileges.
|
||||
- **Elevated Token** [Version 2] [Type = UnicodeString]**:** a "Yes" or "No" flag. If "Yes", then the session this event represents is elevated and has administrator privileges.
|
||||
|
||||
**Impersonation Level** \[Version 1, 2\] \[Type = UnicodeString\]: can have one of these four values:
|
||||
**Impersonation Level** [Version 1, 2] [Type = UnicodeString]: can have one of these four values:
|
||||
|
||||
- SecurityAnonymous (displayed as **empty string**): The server process cannot obtain identification information about the client, and it cannot impersonate the client. It is defined with no value given, and thus, by ANSI C rules, defaults to a value of zero.
|
||||
|
||||
@ -182,13 +185,14 @@ This event generates when a logon session is created (on destination machine). I
|
||||
|
||||
**New Logon:**
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account for which logon was performed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
- **Security ID** [Type = SID]**:** SID of account for which logon was performed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
> [!NOTE]
|
||||
> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account for which logon was performed.
|
||||
- **Account Name** [Type = UnicodeString]**:** the name of the account for which logon was performed.
|
||||
|
||||
- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following:
|
||||
- **Account Domain** [Type = UnicodeString]**:** subject’s domain or computer name. Formats vary, and include the following:
|
||||
|
||||
- Domain NETBIOS name example: CONTOSO
|
||||
|
||||
@ -196,61 +200,62 @@ This event generates when a logon session is created (on destination machine). I
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY".
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81".
|
||||
|
||||
- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4672](event-4672.md)(S): Special privileges assigned to new logon.”
|
||||
- **Logon ID** [Type = HexInt64]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, "[4672](event-4672.md)(S): Special privileges assigned to new logon."
|
||||
|
||||
- **Linked Logon ID** \[Version 2\] \[Type = HexInt64\]**:** A hexadecimal value of the paired logon session. If there is no other logon session associated with this logon session, then the value is “**0x0**”.
|
||||
- **Linked Logon ID** [Version 2] [Type = HexInt64]**:** A hexadecimal value of the paired logon session. If there is no other logon session associated with this logon session, then the value is "**0x0**".
|
||||
|
||||
- **Network Account Name** \[Version 2\] \[Type = UnicodeString\]**:** User name that will be used for outbound (network) connections. Valid only for [NewCredentials](#logon-types-and-descriptions) logon type.
|
||||
- **Network Account Name** [Version 2] [Type = UnicodeString]**:** User name that will be used for outbound (network) connections. Valid only for [NewCredentials](#logon-types-and-descriptions) logon type.
|
||||
|
||||
If not **NewCredentials** logon, then this will be a "-" string.
|
||||
|
||||
- **Network Account Domain** \[Version 2\] \[Type = UnicodeString\]**:** Domain for the user that will be used for outbound (network) connections. Valid only for [NewCredentials](#logon-types-and-descriptions) logon type.
|
||||
- **Network Account Domain** [Version 2] [Type = UnicodeString]**:** Domain for the user that will be used for outbound (network) connections. Valid only for [NewCredentials](#logon-types-and-descriptions) logon type.
|
||||
|
||||
If not **NewCredentials** logon, then this will be a "-" string.
|
||||
|
||||
- **Logon GUID** \[Type = GUID\]: a GUID that can help you correlate this event with another event that can contain the same **Logon GUID**, “[4769](event-4769.md)(S, F): A Kerberos service ticket was requested event on a domain controller.
|
||||
- **Logon GUID** [Type = GUID]: a GUID that can help you correlate this event with another event that can contain the same **Logon GUID**, "[4769](event-4769.md)(S, F): A Kerberos service ticket was requested event on a domain controller.
|
||||
|
||||
It also can be used for correlation between a 4624 event and several other events (on the same computer) that can contain the same **Logon GUID**, “[4648](event-4648.md)(S): A logon was attempted using explicit credentials” and “[4964](event-4964.md)(S): Special groups have been assigned to a new logon.”
|
||||
It also can be used for correlation between a 4624 event and several other events (on the same computer) that can contain the same **Logon GUID**, "[4648](event-4648.md)(S): A logon was attempted using explicit credentials" and "[4964](event-4964.md)(S): Special groups have been assigned to a new logon."
|
||||
|
||||
This parameter might not be captured in the event, and in that case appears as “{00000000-0000-0000-0000-000000000000}”.
|
||||
This parameter might not be captured in the event, and in that case appears as "{00000000-0000-0000-0000-000000000000}".
|
||||
|
||||
> **Note** **GUID** is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities or instances.
|
||||
> [!NOTE]
|
||||
> **GUID** is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities, or instances.
|
||||
|
||||
**Process Information:**
|
||||
|
||||
- **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column):
|
||||
- **Process ID** [Type = Pointer]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column):
|
||||
|
||||
<img src="images/task-manager.png" alt="Task manager illustration" width="585" height="375" />
|
||||
|
||||
If you convert the hexadecimal value to decimal, you can compare it to the values in Task Manager.
|
||||
|
||||
You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**.
|
||||
You can also correlate this process ID with a process ID in other events, for example, "[4688](event-4688.md): A new process has been created" **Process Information\\New Process ID**.
|
||||
|
||||
- **Process Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the process.
|
||||
- **Process Name** [Type = UnicodeString]**:** full path and the name of the executable for the process.
|
||||
|
||||
**Network Information:**
|
||||
|
||||
- **Workstation Name** \[Type = UnicodeString\]**:** machine name to which logon attempt was performed.
|
||||
- **Workstation Name** [Type = UnicodeString]**:** machine name from which a logon attempt was performed.
|
||||
|
||||
- **Source Network Address** \[Type = UnicodeString\]**:** IP address of machine from which logon attempt was performed.
|
||||
- **Source Network Address** [Type = UnicodeString]**:** IP address of machine from which logon attempt was performed.
|
||||
|
||||
- IPv6 address or ::ffff:IPv4 address of a client.
|
||||
|
||||
- ::1 or 127.0.0.1 means localhost.
|
||||
|
||||
- **Source Port** \[Type = UnicodeString\]: source port which was used for logon attempt from remote machine.
|
||||
- **Source Port** [Type = UnicodeString]: source port which was used for logon attempt from remote machine.
|
||||
|
||||
- 0 for interactive logons.
|
||||
|
||||
**Detailed Authentication Information:**
|
||||
|
||||
- **Logon Process** \[Type = UnicodeString\]**:** the name of the trusted logon process that was used for the logon. See event “[4611](event-4611.md): A trusted logon process has been registered with the Local Security Authority” description for more information.
|
||||
- **Logon Process** [Type = UnicodeString]**:** the name of the trusted logon process that was used for the logon. See event "[4611](event-4611.md): A trusted logon process has been registered with the Local Security Authority" description for more information.
|
||||
|
||||
- **Authentication Package** \[Type = UnicodeString\]**:** The name of the authentication package which was used for the logon authentication process. Default packages loaded on LSA startup are located in “HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig” registry key. Other packages can be loaded at runtime. When a new package is loaded a “[4610](event-4610.md): An authentication package has been loaded by the Local Security Authority” (typically for NTLM) or “[4622](event-4622.md): A security package has been loaded by the Local Security Authority” (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name. The most common authentication packages are:
|
||||
- **Authentication Package** [Type = UnicodeString]**:** The name of the authentication package which was used for the logon authentication process. Default packages loaded on LSA startup are located in "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig" registry key. Other packages can be loaded at runtime. When a new package is loaded a "[4610](event-4610.md): An authentication package has been loaded by the Local Security Authority" (typically for NTLM) or "[4622](event-4622.md): A security package has been loaded by the Local Security Authority" (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name. The most common authentication packages are:
|
||||
|
||||
- **NTLM** – NTLM-family Authentication
|
||||
|
||||
@ -258,48 +263,48 @@ This event generates when a logon session is created (on destination machine). I
|
||||
|
||||
- **Negotiate** – the Negotiate security package selects between Kerberos and NTLM protocols. Negotiate selects Kerberos unless it cannot be used by one of the systems involved in the authentication or the calling application did not provide sufficient information to use Kerberos.
|
||||
|
||||
- **Transited Services** \[Type = UnicodeString\] \[Kerberos-only\]**:** the list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see <https://msdn.microsoft.com/library/cc246072.aspx>
|
||||
- **Transited Services** [Type = UnicodeString] [Kerberos-only]**:** the list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see <https://msdn.microsoft.com/library/cc246072.aspx>
|
||||
|
||||
- **Package Name (NTLM only)** \[Type = UnicodeString\]**:** The name of the LAN Manager sub-package ([NTLM-family](/openspecs/windows_protocols/ms-nlmp/c50a85f0-5940-42d8-9e82-ed206902e919) protocol name) that was used during logon. Possible values are:
|
||||
- **Package Name (NTLM only)** [Type = UnicodeString]**:** The name of the LAN Manager sub-package ([NTLM-family](/openspecs/windows_protocols/ms-nlmp/c50a85f0-5940-42d8-9e82-ed206902e919) protocol name) that was used during logon. Possible values are:
|
||||
|
||||
- “NTLM V1”
|
||||
- "NTLM V1"
|
||||
|
||||
- “NTLM V2”
|
||||
- "NTLM V2"
|
||||
|
||||
- “LM”
|
||||
- "LM"
|
||||
|
||||
Only populated if “**Authentication Package” = “NTLM”**.
|
||||
Only populated if "**Authentication Package" = "NTLM"**.
|
||||
|
||||
- **Key Length** \[Type = UInt32\]**:** the length of [NTLM Session Security](/openspecs/windows_protocols/ms-nlmp/99d90ff4-957f-4c8a-80e4-5bfe5a9a9832) key. Typically it has 128 bit or 56 bit length. This parameter is always 0 if “**Authentication Package” = “Kerberos”**, because it is not applicable for Kerberos protocol. This field will also have “0” value if Kerberos was negotiated using **Negotiate** authentication package.
|
||||
- **Key Length** [Type = UInt32]**:** the length of [NTLM Session Security](/openspecs/windows_protocols/ms-nlmp/99d90ff4-957f-4c8a-80e4-5bfe5a9a9832) key. Typically it has 128 bit or 56 bit length. This parameter is always 0 if "**Authentication Package" = "Kerberos"**, because it is not applicable for Kerberos protocol. This field will also have "0" value if Kerberos was negotiated using **Negotiate** authentication package.
|
||||
|
||||
## Security Monitoring Recommendations
|
||||
|
||||
For 4624(S): An account was successfully logged on.
|
||||
|
||||
| **Type of monitoring required** | **Recommendation** |
|
||||
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.<br>Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“New Logon\\Security ID”** that corresponds to the high-value account or accounts. |
|
||||
| **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“New Logon\\Security ID”** (with other information) to monitor how or when a particular account is being used. |
|
||||
| **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“New Logon\\Security ID”** that corresponds to the accounts that should never be used. |
|
||||
| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“New Logon\\Security ID”** for accounts that are outside the allow list. |
|
||||
| **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“New Logon\\Security ID”** to see whether the account type is as expected. |
|
||||
| **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. |
|
||||
| **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“New Logon\\Security ID”** that you are concerned about. |
|
||||
| **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**Subject\\Account Name”** for names that don’t comply with naming conventions. |
|
||||
| Type of monitoring required | Recommendation |
|
||||
|-----------------------------|-------------------------|
|
||||
| **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.<br>Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **"New Logon\\Security ID"** that corresponds to the high-value account or accounts. |
|
||||
| **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **"New Logon\\Security ID"** (with other information) to monitor how or when a particular account is being used. |
|
||||
| **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **"New Logon\\Security ID"** that corresponds to the accounts that should never be used. |
|
||||
| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a "allow list-only" action, review the **"New Logon\\Security ID"** for accounts that are outside the allow list. |
|
||||
| **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **"New Logon\\Security ID"** to see whether the account type is as expected. |
|
||||
| **External accounts**: You might be monitoring accounts from another domain, or "external" accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **"Subject\\Account Domain"** corresponding to accounts from another domain or "external" accounts. |
|
||||
| **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **"New Logon\\Security ID"** that you are concerned about. |
|
||||
| **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor "**Subject\\Account Name"** for names that don’t comply with naming conventions. |
|
||||
|
||||
- Because this event is typically triggered by the SYSTEM account, we recommend that you report it whenever **“Subject\\Security ID”** is not SYSTEM.
|
||||
- Because this event is typically triggered by the SYSTEM account, we recommend that you report it whenever **"Subject\\Security ID"** is not SYSTEM.
|
||||
|
||||
- If “**Restricted Admin**” mode must be used for logons by certain accounts, use this event to monitor logons by “**New Logon\\Security ID**” in relation to “**Logon Type**”=10 and “**Restricted Admin Mode**”=”Yes”. If “**Restricted Admin Mode**”=”No” for these accounts, trigger an alert.
|
||||
- If "**Restricted Admin**" mode must be used for logons by certain accounts, use this event to monitor logons by "**New Logon\\Security ID**" in relation to "**Logon Type**"=10 and "**Restricted Admin Mode**"="Yes". If "**Restricted Admin Mode**"="No" for these accounts, trigger an alert.
|
||||
|
||||
- If you need to monitor all logon events for accounts with administrator privileges, monitor this event with “**Elevated Token**”=”Yes”.
|
||||
- If you need to monitor all logon events for accounts with administrator privileges, monitor this event with "**Elevated Token**"="Yes".
|
||||
|
||||
- If you need to monitor all logon events for managed service accounts and group managed service accounts, monitor for events with “**Virtual Account**”=”Yes”.
|
||||
- If you need to monitor all logon events for managed service accounts and group managed service accounts, monitor for events with "**Virtual Account**"="Yes".
|
||||
|
||||
- To monitor for a mismatch between the logon type and the account that uses it (for example, if **Logon Type** 4-Batch or 5-Service is used by a member of a domain administrative group), monitor **Logon Type** in this event.
|
||||
|
||||
- If your organization restricts logons in the following ways, you can use this event to monitor accordingly:
|
||||
|
||||
- If the user account **“New Logon\\Security ID”** should never be used to log on from the specific **Computer:**.
|
||||
- If the user account **"New Logon\\Security ID"** should never be used to log on from the specific **Computer:**.
|
||||
|
||||
- If **New Logon\\Security ID** credentials should not be used from **Workstation Name** or **Source Network Address**.
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user