From 1fdca55aa46ae5bce8514a0e418e7b9d3bd63b50 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 10 Jul 2020 12:53:07 -0700 Subject: [PATCH 001/143] Create manage-advanced-threat-protection-post-migration.md --- ...vanced-threat-protection-post-migration.md | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-advanced-threat-protection-post-migration.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-advanced-threat-protection-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-advanced-threat-protection-post-migration.md new file mode 100644 index 0000000000..c8905d337a --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-advanced-threat-protection-post-migration.md @@ -0,0 +1,21 @@ +--- +title: Manage Microsoft Defender ATP post migration +description: Now that you've made the switch to Microsoft Defender ATP, your next step is to manage your threat protection features +keywords: post-migration, manage, operations, maintenance, utilization, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Manage Microsoft Defender Advanced Threat Protection post migration + From c447df235b67aeeb68016a288bc7e88eba946682 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 10 Jul 2020 12:54:06 -0700 Subject: [PATCH 002/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 666cf8cb70..809def3fba 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -26,6 +26,7 @@ #### [Prepare for your migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md) #### [Set up Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md) #### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md) +### [Manage Microsoft Defender ATP post migration](microsoft-defender-atp/manage-advanced-threat-protection-post-migration.md) ## [Security administration]() ### [Threat & Vulnerability Management]() From 9af8c8fb8e0d4adfa46a4e6a62d2393c2b7ea047 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 10 Jul 2020 12:56:40 -0700 Subject: [PATCH 003/143] manage content --- windows/security/threat-protection/TOC.md | 2 +- ...rotection-post-migration.md => manage-atp-post-migration.md} | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename windows/security/threat-protection/microsoft-defender-atp/{manage-advanced-threat-protection-post-migration.md => manage-atp-post-migration.md} (100%) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 809def3fba..1177bedda8 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -26,7 +26,7 @@ #### [Prepare for your migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md) #### [Set up Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md) #### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md) -### [Manage Microsoft Defender ATP post migration](microsoft-defender-atp/manage-advanced-threat-protection-post-migration.md) +### [Manage Microsoft Defender ATP post migration](microsoft-defender-atp/manage-atp-post-migration.md) ## [Security administration]() ### [Threat & Vulnerability Management]() diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-advanced-threat-protection-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/manage-advanced-threat-protection-post-migration.md rename to windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md From ca2b3927bd78c7d6ffc786deb27dc1d820abac7b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 10 Jul 2020 12:58:27 -0700 Subject: [PATCH 004/143] Create manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md new file mode 100644 index 0000000000..26fb32834f --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -0,0 +1,21 @@ +--- +title: Manage Microsoft Defender ATP using Intune +description: Learn how to manage Microsoft Defender ATP with Intune +keywords: post-migration, manage, operations, maintenance, utilization, intune, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Manage Microsoft Defender Advanced Threat Protection with Intune + From 782fcef6e274ab98a997cf9af1572ea734004437 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 14 Jul 2020 13:39:10 -0700 Subject: [PATCH 005/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index c8905d337a..13e02958a8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -19,3 +19,10 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection post migration +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, you can choose from among several methods to manage your features and capabilities. + + + From 424f6ec9951f109670eef9848b4f59e80119785f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 14 Jul 2020 14:02:40 -0700 Subject: [PATCH 006/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 13e02958a8..2dfdde89ac 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -22,7 +22,14 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, you can choose from among several methods to manage your features and capabilities. +After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, you can choose from among several methods to manage your features and capabilities. These methods include the following: +- Intune +- Configuration Manager (formerly System Center Configuration Manager) +- Group Policy Objects +- Windows PowerShell +- Windows Management Instrumentation +- Microsoft Malware Protection Command Line Utility + From 1437789e2411255a089d4cef7b55f275afc91a0b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 14 Jul 2020 14:03:11 -0700 Subject: [PATCH 007/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 2dfdde89ac..5361df5d3f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -30,6 +30,6 @@ After you have moved from your previous endpoint protection and antivirus soluti - Windows Management Instrumentation - Microsoft Malware Protection Command Line Utility - +Use this article as a guide to managing Microsoft Defender ATP post migration. From 10038451b2fb7ebdfe0353fe28f9f596816685ec Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 14 Jul 2020 14:23:02 -0700 Subject: [PATCH 008/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 5361df5d3f..c30abc0ae8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -33,3 +33,5 @@ After you have moved from your previous endpoint protection and antivirus soluti Use this article as a guide to managing Microsoft Defender ATP post migration. + + From 330b1ffa043276d04e018763de44f596e36f1359 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 15 Jul 2020 14:15:55 -0700 Subject: [PATCH 009/143] Update manage-atp-post-migration.md --- .../manage-atp-post-migration.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index c30abc0ae8..0f75147d26 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -22,15 +22,19 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, you can choose from among several methods to manage your features and capabilities. These methods include the following: -- Intune +After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. Use this article as a guide to getting started managing your threat protection features in Microsoft Defender ATP post migration. + +Depending on what you want to configure, you can use one of several methods/tools: +- Intune (part of Microsoft Endpoint Manager) - Configuration Manager (formerly System Center Configuration Manager) -- Group Policy Objects -- Windows PowerShell -- Windows Management Instrumentation -- Microsoft Malware Protection Command Line Utility +- Group Policy Objects (in Azure Active Directory Domain Services) +- PowerShell (Windows, Linux, and macOS) +- Windows Management Instrumentation (for Windows devices only) +- Microsoft Malware Protection Command Line Utility (this is often referred to as *MPCmdRun.exe*) + +However, not all methods can be used to configure all the capabilities of Microsoft Defender ATP. + -Use this article as a guide to managing Microsoft Defender ATP post migration. From 1ec48940a0b8f6c5300b63958174800d58c853dd Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 15 Jul 2020 14:39:43 -0700 Subject: [PATCH 010/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 26fb32834f..85d7ccbbb2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -19,3 +19,13 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with Intune +We recommend using Intune to manage threat protection features for the devices (also referred to as endpoints) within your organization. + +The following table lists various tasks and resources to manage features and capabilities of Microsoft Defender ATP with Intune. + + +|Task |Resources to learn more | +|---------|---------| +|Manage devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | +|Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution for Android devices and devices running Windows 10 or later |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | + \ No newline at end of file From 79787829242d8ae59c94f9c298c6b93b4feff4bc Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 15 Jul 2020 14:46:32 -0700 Subject: [PATCH 011/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 85d7ccbbb2..121a0ccffe 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -28,4 +28,5 @@ The following table lists various tasks and resources to manage features and cap |---------|---------| |Manage devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | |Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution for Android devices and devices running Windows 10 or later |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | +|Configure Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | \ No newline at end of file From cae66d6b85b239c95b1a055200b69f7a37be8e9f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 15 Jul 2020 14:47:37 -0700 Subject: [PATCH 012/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 121a0ccffe..43f0e2a113 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -19,14 +19,11 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with Intune -We recommend using Intune to manage threat protection features for the devices (also referred to as endpoints) within your organization. - -The following table lists various tasks and resources to manage features and capabilities of Microsoft Defender ATP with Intune. - +We recommend using Intune to manage threat protection features for the devices (also referred to as endpoints) within your organization. This article lists various tasks you can perform using Intune together with resources to learn more. |Task |Resources to learn more | |---------|---------| -|Manage devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | +|Manage your organization's devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | |Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution for Android devices and devices running Windows 10 or later |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | |Configure Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | \ No newline at end of file From 8b19ef0df075d2a15d56f2e348a8ce9ead69eaba Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 15 Jul 2020 14:51:19 -0700 Subject: [PATCH 013/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 43f0e2a113..ff8c8e347e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -26,4 +26,5 @@ We recommend using Intune to manage threat protection features for the devices ( |Manage your organization's devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | |Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution for Android devices and devices running Windows 10 or later |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | |Configure Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | +|Configure Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) \ No newline at end of file From 5774ef10f287e37431cf609aa824aa3752f4b74a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 15 Jul 2020 14:54:04 -0700 Subject: [PATCH 014/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index ff8c8e347e..7b02f9cb89 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -26,5 +26,5 @@ We recommend using Intune to manage threat protection features for the devices ( |Manage your organization's devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | |Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution for Android devices and devices running Windows 10 or later |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | |Configure Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | -|Configure Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) +|Configure Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10) | \ No newline at end of file From 5c8b088a65e3750a130a907ea0e75f4c47d95e0b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 15 Jul 2020 14:56:24 -0700 Subject: [PATCH 015/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 7b02f9cb89..be2429034d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -24,7 +24,8 @@ We recommend using Intune to manage threat protection features for the devices ( |Task |Resources to learn more | |---------|---------| |Manage your organization's devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | -|Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution for Android devices and devices running Windows 10 or later |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | -|Configure Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | -|Configure Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10) | +|Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution
(for Android devices and devices running Windows 10 or later) |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | +|Use Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | +|Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10) | + \ No newline at end of file From 8aac77366e9dc715b32c9114f59d74cd40832094 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 15 Jul 2020 15:51:41 -0700 Subject: [PATCH 016/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index be2429034d..d5fc5c71ed 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -26,6 +26,7 @@ We recommend using Intune to manage threat protection features for the devices ( |Manage your organization's devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | |Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution
(for Android devices and devices running Windows 10 or later) |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | |Use Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | -|Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10) | - +|Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus) | +|If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |Windows 10 devices: [Device restrictions: Microsoft Defender Antivirus Exclusions](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

Windows Server 2016 and 2019: [Configure Microsoft Defender Antivirus exclusions on Windows Server](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)

[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)| +|Configure your attack surface reduction rules and exploit protection (formerly Microsoft Defender Exploit Guard)

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)

[Enable exploit protection using Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune)

[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard) | \ No newline at end of file From e9eda0b60e0875783a72f6a67837dab855c933c7 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 15 Jul 2020 16:16:50 -0700 Subject: [PATCH 017/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index d5fc5c71ed..e24e23d35d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -28,5 +28,6 @@ We recommend using Intune to manage threat protection features for the devices ( |Use Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | |Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus) | |If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |Windows 10 devices: [Device restrictions: Microsoft Defender Antivirus Exclusions](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

Windows Server 2016 and 2019: [Configure Microsoft Defender Antivirus exclusions on Windows Server](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)

[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)| -|Configure your attack surface reduction rules and exploit protection (formerly Microsoft Defender Exploit Guard)

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)

[Enable exploit protection using Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune)

[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard) | +|Configure your attack surface reduction rules and exploit protection (formerly Microsoft Defender Exploit Guard)

*TIPS*:
- *Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*
- *Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Update for Microsoft Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform)

[Enable exploit protection using Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune)

[Attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)

[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard) | +|Configure network protection | | \ No newline at end of file From 12d02dc040b84b13b07149221511339404bc3688 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 15 Jul 2020 16:24:32 -0700 Subject: [PATCH 018/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index e24e23d35d..468c7789a3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -27,7 +27,7 @@ We recommend using Intune to manage threat protection features for the devices ( |Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution
(for Android devices and devices running Windows 10 or later) |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | |Use Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | |Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus) | -|If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |Windows 10 devices: [Device restrictions: Microsoft Defender Antivirus Exclusions](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

Windows Server 2016 and 2019: [Configure Microsoft Defender Antivirus exclusions on Windows Server](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)

[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)| -|Configure your attack surface reduction rules and exploit protection (formerly Microsoft Defender Exploit Guard)

*TIPS*:
- *Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*
- *Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Update for Microsoft Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform)

[Enable exploit protection using Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune)

[Attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)

[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard) | -|Configure network protection | | +|If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| +|Configure your attack surface reduction, network protection, and exploit protection (formerly Microsoft Defender Exploit Guard)

*TIPS*:
- *Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*
- *Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Update for Microsoft Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform)

[Enable exploit protection using Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune)

[Attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)

[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard) | +|Configure network filtering (also referred to as network protection) | | \ No newline at end of file From 214e4a324e4e920378ed9b7ad6df265b1e9bce55 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 15 Jul 2020 16:33:38 -0700 Subject: [PATCH 019/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 468c7789a3..e16e7dd956 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -28,6 +28,5 @@ We recommend using Intune to manage threat protection features for the devices ( |Use Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | |Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus) | |If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| -|Configure your attack surface reduction, network protection, and exploit protection (formerly Microsoft Defender Exploit Guard)

*TIPS*:
- *Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*
- *Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Update for Microsoft Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform)

[Enable exploit protection using Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune)

[Attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)

[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard) | -|Configure network filtering (also referred to as network protection) | | - \ No newline at end of file +|Configure your attack surface reduction rules

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint Protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | +| | | \ No newline at end of file From 0c0e29761b9249aeb3ab5664cccc7d8145942505 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 11:28:30 -0700 Subject: [PATCH 020/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index e16e7dd956..b386561c24 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -28,5 +28,7 @@ We recommend using Intune to manage threat protection features for the devices ( |Use Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | |Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus) | |If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| -|Configure your attack surface reduction rules

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint Protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | -| | | \ No newline at end of file +|Configure your attack surface reduction rules

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | +|Configure your network filtering (this is also referred to as network protection)

*TIP: Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | +|Configure controlled folder access (this is also referred to as antiransomware) |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access) | +| | | \ No newline at end of file From 6dd8720fbfccbe8c2c01874a3870f15ceadc400c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 12:17:27 -0700 Subject: [PATCH 021/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 27 ++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index b386561c24..d89d703569 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -19,7 +19,11 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with Intune -We recommend using Intune to manage threat protection features for the devices (also referred to as endpoints) within your organization. This article lists various tasks you can perform using Intune together with resources to learn more. +We recommend using Intune to manage threat protection features for the devices (also referred to as endpoints) within your organization. + +## Configuring Microsoft Defender ATP with Intune + +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. |Task |Resources to learn more | |---------|---------| @@ -30,5 +34,22 @@ We recommend using Intune to manage threat protection features for the devices ( |If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| |Configure your attack surface reduction rules

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | |Configure your network filtering (this is also referred to as network protection)

*TIP: Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | -|Configure controlled folder access (this is also referred to as antiransomware) |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access) | -| | | \ No newline at end of file +|Configure controlled folder access (this is also referred to as antiransomware) |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | +| | | + + +## Configure threat protection settings in Intune + +> [!IMPORTANT] +> You must be a global administrator or service administrator in Intune to configure the settings described in this article. To learn more, see [Types of administrators (Intune)](https://docs.microsoft.com/mem/intune/fundamentals/users-add#types-of-administrators). + +1. Go to the Azure portal ([https://portal.azure.com](https://portal.azure.com)) and sign in. + +2. Under **Azure Services**, choose **Intune**. + +3. In the navigation pane on the left, choose **Device configuration**, and then, under **Manage**, choose **Profiles**. + +4. Select an existing profile, or create a new one. + +> [!TIP] +> Need help? See [Using Microsoft Defender ATP with Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection#example-of-using-microsoft-defender-atp-with-intune). \ No newline at end of file From 7b6a785f99ade8956b0a78abfb94f37491ecb7e1 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 12:23:50 -0700 Subject: [PATCH 022/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index d89d703569..eb2cf9faae 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -38,7 +38,7 @@ The following table lists various tasks you can perform to configure Microsoft D | | | -## Configure threat protection settings in Intune +## Find your Microsoft Defender ATP settings in Intune > [!IMPORTANT] > You must be a global administrator or service administrator in Intune to configure the settings described in this article. To learn more, see [Types of administrators (Intune)](https://docs.microsoft.com/mem/intune/fundamentals/users-add#types-of-administrators). From 252709b5e949b7278446af0f8484a8b614a4a23d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 12:29:54 -0700 Subject: [PATCH 023/143] Create manage-atp-post-migration-configuration-manager.md --- ...tp-post-migration-configuration-manager.md | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md new file mode 100644 index 0000000000..b6de4062b1 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -0,0 +1,48 @@ +--- +title: Manage Microsoft Defender ATP using Configuration Manager +description: Learn how to manage Microsoft Defender ATP with Configuration Manager +keywords: post-migration, manage, operations, maintenance, utilization, Configuration Manager, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Manage Microsoft Defender Advanced Threat Protection with Configuration Manager + +We recommend using Configuration Manager to manage threat protection features for the devices (also referred to as endpoints) within your organization. + +## Configuring Microsoft Defender ATP with Configuration Manager + +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Configuration Manager. + +|Task |Resources to learn more | +|---------|---------| +|Manage your organization's devices using Configuration Manager |link | +|task |link | + + +## Find your Microsoft Defender ATP settings in Configuration Manager + +> [!IMPORTANT] +> You must be a global administrator or service administrator in Configuration Manager to configure the settings described in this article. To learn more, see link. + +1. Go to the where and sign in. + +2. Under what choose what. + +3. next + +4. and next + +> [!TIP] +> Need help? See link. \ No newline at end of file From 8ddd509c580a7212e840b5df491879e07f4e2ee8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 12:30:46 -0700 Subject: [PATCH 024/143] Create manage-atp-post-migration-group-policy-objects.md --- ...atp-post-migration-group-policy-objects.md | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md new file mode 100644 index 0000000000..b6de4062b1 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -0,0 +1,48 @@ +--- +title: Manage Microsoft Defender ATP using Configuration Manager +description: Learn how to manage Microsoft Defender ATP with Configuration Manager +keywords: post-migration, manage, operations, maintenance, utilization, Configuration Manager, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Manage Microsoft Defender Advanced Threat Protection with Configuration Manager + +We recommend using Configuration Manager to manage threat protection features for the devices (also referred to as endpoints) within your organization. + +## Configuring Microsoft Defender ATP with Configuration Manager + +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Configuration Manager. + +|Task |Resources to learn more | +|---------|---------| +|Manage your organization's devices using Configuration Manager |link | +|task |link | + + +## Find your Microsoft Defender ATP settings in Configuration Manager + +> [!IMPORTANT] +> You must be a global administrator or service administrator in Configuration Manager to configure the settings described in this article. To learn more, see link. + +1. Go to the where and sign in. + +2. Under what choose what. + +3. next + +4. and next + +> [!TIP] +> Need help? See link. \ No newline at end of file From 79de3bc46ace4131b2b3feb6bb1ce0d28afc30a9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 12:32:15 -0700 Subject: [PATCH 025/143] Update manage-atp-post-migration-group-policy-objects.md --- ...atp-post-migration-group-policy-objects.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index b6de4062b1..5cc53fbc0d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -1,7 +1,7 @@ --- -title: Manage Microsoft Defender ATP using Configuration Manager -description: Learn how to manage Microsoft Defender ATP with Configuration Manager -keywords: post-migration, manage, operations, maintenance, utilization, Configuration Manager, windows defender advanced threat protection, atp, edr +title: Manage Microsoft Defender ATP using Group Policy Objects +description: Learn how to manage Microsoft Defender ATP with Group Policy Objects +keywords: post-migration, manage, operations, maintenance, utilization, Group Policy Objects, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -17,24 +17,24 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Manage Microsoft Defender Advanced Threat Protection with Configuration Manager +# Manage Microsoft Defender Advanced Threat Protection with Group Policy Objects -We recommend using Configuration Manager to manage threat protection features for the devices (also referred to as endpoints) within your organization. +We recommend using Group Policy Objects to manage threat protection features for the devices (also referred to as endpoints) within your organization. -## Configuring Microsoft Defender ATP with Configuration Manager +## Configuring Microsoft Defender ATP with Group Policy Objects -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Configuration Manager. +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Group Policy Objects. |Task |Resources to learn more | |---------|---------| -|Manage your organization's devices using Configuration Manager |link | +|Manage your organization's devices using Group Policy Objects |link | |task |link | -## Find your Microsoft Defender ATP settings in Configuration Manager +## Find your Microsoft Defender ATP settings in Group Policy Objects > [!IMPORTANT] -> You must be a global administrator or service administrator in Configuration Manager to configure the settings described in this article. To learn more, see link. +> You must be a WHAT in WHERE to configure Group Policy Objects. To learn more, see link. 1. Go to the where and sign in. From a290885bce101e012346bcdd1f6013592b929368 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 12:33:33 -0700 Subject: [PATCH 026/143] Create manage-atp-post-migration-powershell.md --- .../manage-atp-post-migration-powershell.md | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-powershell.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-powershell.md new file mode 100644 index 0000000000..5cc53fbc0d --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-powershell.md @@ -0,0 +1,48 @@ +--- +title: Manage Microsoft Defender ATP using Group Policy Objects +description: Learn how to manage Microsoft Defender ATP with Group Policy Objects +keywords: post-migration, manage, operations, maintenance, utilization, Group Policy Objects, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Manage Microsoft Defender Advanced Threat Protection with Group Policy Objects + +We recommend using Group Policy Objects to manage threat protection features for the devices (also referred to as endpoints) within your organization. + +## Configuring Microsoft Defender ATP with Group Policy Objects + +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Group Policy Objects. + +|Task |Resources to learn more | +|---------|---------| +|Manage your organization's devices using Group Policy Objects |link | +|task |link | + + +## Find your Microsoft Defender ATP settings in Group Policy Objects + +> [!IMPORTANT] +> You must be a WHAT in WHERE to configure Group Policy Objects. To learn more, see link. + +1. Go to the where and sign in. + +2. Under what choose what. + +3. next + +4. and next + +> [!TIP] +> Need help? See link. \ No newline at end of file From 7b700eb92dedb817f93ca6c19c29e968262fb567 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 12:34:06 -0700 Subject: [PATCH 027/143] Update manage-atp-post-migration-group-policy-objects.md --- ...atp-post-migration-group-policy-objects.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 5cc53fbc0d..715c306fdb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -1,7 +1,7 @@ --- -title: Manage Microsoft Defender ATP using Group Policy Objects -description: Learn how to manage Microsoft Defender ATP with Group Policy Objects -keywords: post-migration, manage, operations, maintenance, utilization, Group Policy Objects, windows defender advanced threat protection, atp, edr +title: Manage Microsoft Defender ATP using PowerShell +description: Learn how to manage Microsoft Defender ATP with PowerShell +keywords: post-migration, manage, operations, maintenance, utilization, PowerShell, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -17,24 +17,24 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Manage Microsoft Defender Advanced Threat Protection with Group Policy Objects +# Manage Microsoft Defender Advanced Threat Protection with PowerShell -We recommend using Group Policy Objects to manage threat protection features for the devices (also referred to as endpoints) within your organization. +We recommend using PowerShell to manage threat protection features for the devices (also referred to as endpoints) within your organization. -## Configuring Microsoft Defender ATP with Group Policy Objects +## Configuring Microsoft Defender ATP with PowerShell -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Group Policy Objects. +The following table lists various tasks you can perform to configure Microsoft Defender ATP with PowerShell. |Task |Resources to learn more | |---------|---------| -|Manage your organization's devices using Group Policy Objects |link | +|Manage your organization's devices using PowerShell |link | |task |link | -## Find your Microsoft Defender ATP settings in Group Policy Objects +## Find your Microsoft Defender ATP settings in PowerShell > [!IMPORTANT] -> You must be a WHAT in WHERE to configure Group Policy Objects. To learn more, see link. +> You must be a WHAT in WHERE to configure PowerShell. To learn more, see link. 1. Go to the where and sign in. From e4ef86a70c91bce9e901b652b72349c88c64d260 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 12:35:39 -0700 Subject: [PATCH 028/143] Create manage-atp-post-migration-wmi.md --- .../manage-atp-post-migration-wmi.md | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-wmi.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-wmi.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-wmi.md new file mode 100644 index 0000000000..458c2c3604 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-wmi.md @@ -0,0 +1,48 @@ +--- +title: Manage Microsoft Defender ATP using Windows Management Instrumentation +description: Learn how to manage Microsoft Defender ATP with Windows Management Instrumentation +keywords: post-migration, manage, operations, maintenance, utilization, Windows Management Instrumentation, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Manage Microsoft Defender Advanced Threat Protection with Windows Management Instrumentation + +We recommend using Windows Management Instrumentation to manage threat protection features for the devices (also referred to as endpoints) within your organization. + +## Configuring Microsoft Defender ATP with Windows Management Instrumentation + +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Windows Management Instrumentation. + +|Task |Resources to learn more | +|---------|---------| +|Manage your organization's devices using Windows Management Instrumentation |link | +|task |link | + + +## Find your Microsoft Defender ATP settings in Windows Management Instrumentation + +> [!IMPORTANT] +> You must be a WHAT in WHERE to configure Windows Management Instrumentation. To learn more, see link. + +1. Go to the where and sign in. + +2. Under what choose what. + +3. next + +4. and next + +> [!TIP] +> Need help? See link. \ No newline at end of file From ec9557b54fa5d7654fb286c32504c39a805ed154 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 12:37:36 -0700 Subject: [PATCH 029/143] Create manage-atp-post-migration-mpcmdrun.md --- .../manage-atp-post-migration-mpcmdrun.md | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-mpcmdrun.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-mpcmdrun.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-mpcmdrun.md new file mode 100644 index 0000000000..ceb05f4934 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-mpcmdrun.md @@ -0,0 +1,48 @@ +--- +title: Manage Microsoft Defender ATP using Microsoft Malware Protection Command Line Utility +description: Learn how to manage Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility +keywords: post-migration, manage, operations, maintenance, utilization, Microsoft Malware Protection Command Line Utility, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Manage Microsoft Defender Advanced Threat Protection with Microsoft Malware Protection Command Line Utility + +We recommend using Microsoft Malware Protection Command Line Utility to manage threat protection features for the devices (also referred to as endpoints) within your organization. + +## Configuring Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility + +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility. + +|Task |Resources to learn more | +|---------|---------| +|Manage your organization's devices using Microsoft Malware Protection Command Line Utility |link | +|task |link | + + +## Find your Microsoft Defender ATP settings in Microsoft Malware Protection Command Line Utility + +> [!IMPORTANT] +> You must be a WHAT in WHERE to configure Microsoft Malware Protection Command Line Utility. To learn more, see link. + +1. Go to the where and sign in. + +2. Under what choose what. + +3. next + +4. and next + +> [!TIP] +> Need help? See link. \ No newline at end of file From 34b95c28dcb72e04566c20c1e19d598a380b534e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 12:41:33 -0700 Subject: [PATCH 030/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 1177bedda8..b14e476d18 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -27,6 +27,12 @@ #### [Set up Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md) #### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md) ### [Manage Microsoft Defender ATP post migration](microsoft-defender-atp/manage-atp-post-migration.md) +#### [Use Intune](microsoft-defender-atp/manage-atp-post-migration-intune.md) +#### [Use Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md) +#### [Use PowerShell](microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md) +#### [Use Group Policy Objects](microsoft-defender-atp/manage-atp-post-migration-powershell.md) +#### [Use Windows Management Instrumentation](microsoft-defender-atp/manage-atp-post-migration-wmi.md) +#### [Use the Microsoft Malware Protection Command Line Utility](microsoft-defender-atp/manage-atp-post-migration-mpcmdrun.md) ## [Security administration]() ### [Threat & Vulnerability Management]() From b47959520873e032a492b43088d736eadbcb3149 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 13:17:00 -0700 Subject: [PATCH 031/143] Update manage-atp-post-migration.md --- .../manage-atp-post-migration.md | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 0f75147d26..57f7ef05fc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -24,15 +24,22 @@ ms.topic: article After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. Use this article as a guide to getting started managing your threat protection features in Microsoft Defender ATP post migration. -Depending on what you want to configure, you can use one of several methods/tools: -- Intune (part of Microsoft Endpoint Manager) -- Configuration Manager (formerly System Center Configuration Manager) -- Group Policy Objects (in Azure Active Directory Domain Services) -- PowerShell (Windows, Linux, and macOS) -- Windows Management Instrumentation (for Windows devices only) -- Microsoft Malware Protection Command Line Utility (this is often referred to as *MPCmdRun.exe*) +Depending on what you want to configure, you can use one of several methods/tools, as listed in the following table: -However, not all methods can be used to configure all the capabilities of Microsoft Defender ATP. +| Use this tool/method... | To configure these Microsoft Defender ATP settings | +|---|---| +|Intune (part of Microsoft Endpoint Manager) |list | +| Configuration Manager (formerly System Center Configuration Manager) | | +| Group Policy Objects (in Azure Active Directory Domain Services) | | +| PowerShell (Windows, Linux, and macOS) | | +| Windows Management Instrumentation (for Windows devices only) | | +| Microsoft Malware Protection Command Line Utility (this is often referred to as *MPCmdRun.exe*) | | + +## Additional resources + +|Subject | Resources | +|---|---| +|General resources |- [Microsoft Defender Antivirus documentation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) ([http://aka.ms/wdavtechnet](http://aka.ms/wdavtechnet))

- [Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi) ([http://www.microsoft.com/mmpc](http://www.microsoft.com/mmpc)) | From c668b8e8163aea2a48613b549531774afe2f3dc8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 13:26:11 -0700 Subject: [PATCH 032/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 57f7ef05fc..0278ee04d7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -39,10 +39,5 @@ Depending on what you want to configure, you can use one of several methods/tool |Subject | Resources | |---|---| -|General resources |- [Microsoft Defender Antivirus documentation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) ([http://aka.ms/wdavtechnet](http://aka.ms/wdavtechnet))

- [Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi) ([http://www.microsoft.com/mmpc](http://www.microsoft.com/mmpc)) | - - - - - - +|General resources |- Microsoft Defender Antivirus documentation ([http://aka.ms/wdavtechnet](http://aka.ms/wdavtechnet))

- Microsoft Security Intelligence ([http://www.microsoft.com/mmpc](http://www.microsoft.com/mmpc))

- Microsoft Security blog ([https://aka.ms/mmpcblog](https://aka.ms/mmpcblog)) | +|Endpoint Protection (Configuration Manager) |[Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | \ No newline at end of file From 7f5745cd82f20a65bda8a370f28042b12d13254c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 14:00:28 -0700 Subject: [PATCH 033/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 0278ee04d7..5539fa61b5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -40,4 +40,5 @@ Depending on what you want to configure, you can use one of several methods/tool |Subject | Resources | |---|---| |General resources |- Microsoft Defender Antivirus documentation ([http://aka.ms/wdavtechnet](http://aka.ms/wdavtechnet))

- Microsoft Security Intelligence ([http://www.microsoft.com/mmpc](http://www.microsoft.com/mmpc))

- Microsoft Security blog ([https://aka.ms/mmpcblog](https://aka.ms/mmpcblog)) | -|Endpoint Protection (Configuration Manager) |[Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | \ No newline at end of file +|Endpoint Protection (Configuration Manager) |[Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | +|Test and deploy Microsoft Defender Antivirus |- | \ No newline at end of file From c3f3202c92dc41f9e225342d1fae2ee53dad2eb0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 16 Jul 2020 14:02:20 -0700 Subject: [PATCH 034/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index b14e476d18..396f48c2f0 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -26,7 +26,8 @@ #### [Prepare for your migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md) #### [Set up Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md) #### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md) -### [Manage Microsoft Defender ATP post migration](microsoft-defender-atp/manage-atp-post-migration.md) +### [Manage Microsoft Defender ATP post migration]() +#### [Overview](microsoft-defender-atp/manage-atp-post-migration.md) #### [Use Intune](microsoft-defender-atp/manage-atp-post-migration-intune.md) #### [Use Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md) #### [Use PowerShell](microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md) From a998653e8c90e13e29f3ee06650b515d7a538ad2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Jul 2020 10:11:21 -0700 Subject: [PATCH 035/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 38 ++++++++++--------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index eb2cf9faae..828cdbf280 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -21,23 +21,6 @@ ms.topic: article We recommend using Intune to manage threat protection features for the devices (also referred to as endpoints) within your organization. -## Configuring Microsoft Defender ATP with Intune - -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. - -|Task |Resources to learn more | -|---------|---------| -|Manage your organization's devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | -|Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution
(for Android devices and devices running Windows 10 or later) |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | -|Use Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | -|Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus) | -|If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| -|Configure your attack surface reduction rules

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | -|Configure your network filtering (this is also referred to as network protection)

*TIP: Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | -|Configure controlled folder access (this is also referred to as antiransomware) |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | -| | | - - ## Find your Microsoft Defender ATP settings in Intune > [!IMPORTANT] @@ -52,4 +35,23 @@ The following table lists various tasks you can perform to configure Microsoft D 4. Select an existing profile, or create a new one. > [!TIP] -> Need help? See [Using Microsoft Defender ATP with Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection#example-of-using-microsoft-defender-atp-with-intune). \ No newline at end of file +> Need help? See [Using Microsoft Defender ATP with Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection#example-of-using-microsoft-defender-atp-with-intune). + +## Configure Microsoft Defender ATP with Intune + +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. + +|Task |Resources to learn more | +|---------|---------| +|Manage your organization's devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | +|Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution
(for Android devices and devices running Windows 10 or later) |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | +|Use Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | +|Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus) | +|If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| +|Configure your attack surface reduction rules

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | +|Configure your network filtering (this is also referred to as network protection)

*TIP: Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | +|Configure controlled folder access (this is also referred to as antiransomware) |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | +|Configure exploit protection (formerly referred to as Exploit Guard) |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | +|Configure Microsoft Defender SmartScreen to protect against malicious sites and files on the internet |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen) | + + From ccb9f504edaf37e412436c306fb2cb9c2518c358 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Jul 2020 10:22:03 -0700 Subject: [PATCH 036/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 828cdbf280..85caad23e1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -52,6 +52,6 @@ The following table lists various tasks you can perform to configure Microsoft D |Configure your network filtering (this is also referred to as network protection)

*TIP: Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | |Configure controlled folder access (this is also referred to as antiransomware) |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | |Configure exploit protection (formerly referred to as Exploit Guard) |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | -|Configure Microsoft Defender SmartScreen to protect against malicious sites and files on the internet |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen) | +|Configure Microsoft Defender SmartScreen to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen) | From 7e713409a63e6e38b439b3ed08c1c85730a56315 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Jul 2020 10:33:58 -0700 Subject: [PATCH 037/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 85caad23e1..23e2c25031 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -53,5 +53,6 @@ The following table lists various tasks you can perform to configure Microsoft D |Configure controlled folder access (this is also referred to as antiransomware) |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | |Configure exploit protection (formerly referred to as Exploit Guard) |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | |Configure Microsoft Defender SmartScreen to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen) | +|Microsoft Defender Firewall |[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)

[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall) | From ae99116443c3b3935b11a43024473787b564e9c3 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Jul 2020 10:45:00 -0700 Subject: [PATCH 038/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 23e2c25031..d1813b4b1d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -52,7 +52,8 @@ The following table lists various tasks you can perform to configure Microsoft D |Configure your network filtering (this is also referred to as network protection)

*TIP: Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | |Configure controlled folder access (this is also referred to as antiransomware) |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | |Configure exploit protection (formerly referred to as Exploit Guard) |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | -|Configure Microsoft Defender SmartScreen to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen) | -|Microsoft Defender Firewall |[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)

[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall) | +|Configure Microsoft Defender SmartScreen to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings) | +|Configure Microsoft Defender Firewall to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | +|Configure encryption and BitLocker |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | From 1f945a487a022fc78ce121ec8e14786bb9b1275e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Jul 2020 10:58:30 -0700 Subject: [PATCH 039/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index d1813b4b1d..71e90831b8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -55,5 +55,7 @@ The following table lists various tasks you can perform to configure Microsoft D |Configure Microsoft Defender SmartScreen to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings) | |Configure Microsoft Defender Firewall to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | |Configure encryption and BitLocker |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | +|Configure Microsoft Defender Credential Guard to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | +|Configure your Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture |[]()

[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) | From 673dfb9ac7d0dba3363ea233d6889d67d1313246 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Jul 2020 10:59:40 -0700 Subject: [PATCH 040/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 71e90831b8..b7730d5890 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -56,6 +56,6 @@ The following table lists various tasks you can perform to configure Microsoft D |Configure Microsoft Defender Firewall to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | |Configure encryption and BitLocker |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | |Configure Microsoft Defender Credential Guard to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | -|Configure your Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture |[]()

[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) | +|Configure your Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture |[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center)

[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) | From 532cd008fa5ab1e228797b3839418e47cc8b2027 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Jul 2020 11:17:36 -0700 Subject: [PATCH 041/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index b7730d5890..9b2c38bff2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -46,16 +46,17 @@ The following table lists various tasks you can perform to configure Microsoft D |Manage your organization's devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | |Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution
(for Android devices and devices running Windows 10 or later) |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | |Use Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | -|Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender)

[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus) | +|Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus)

[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) | |If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| |Configure your attack surface reduction rules

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | |Configure your network filtering (this is also referred to as network protection)

*TIP: Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | -|Configure controlled folder access (this is also referred to as antiransomware) |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | -|Configure exploit protection (formerly referred to as Exploit Guard) |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | +|Configure controlled folder access to protect against ransomware

*Controlled folder access is also referred to as antiransomware protection.* |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | +|Configure exploit protection to protect your organization's devices from malware that uses exploits to spread and infect other devices

*Exploit protection is also referred to as Exploit Guard.* |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | |Configure Microsoft Defender SmartScreen to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings) | |Configure Microsoft Defender Firewall to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | |Configure encryption and BitLocker |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | |Configure Microsoft Defender Credential Guard to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | -|Configure your Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture |[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center)

[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) | +|Configure your Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture.

You can also configure whether and what features end users can see in the Microsoft Defender Security Center. |[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center)

[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) | +|Configure Microsoft Defender Application Control (also referred to as AppLocker) to choose whether to audit or trust apps on your organization's devices |[AppLocker overview](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview)
[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)
[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| From ebf4ce149c04176cb13cbc1ed42ce01e38eb9b66 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Jul 2020 11:20:16 -0700 Subject: [PATCH 042/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 9b2c38bff2..44abfcb9c6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -54,7 +54,7 @@ The following table lists various tasks you can perform to configure Microsoft D |Configure exploit protection to protect your organization's devices from malware that uses exploits to spread and infect other devices

*Exploit protection is also referred to as Exploit Guard.* |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | |Configure Microsoft Defender SmartScreen to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings) | |Configure Microsoft Defender Firewall to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | -|Configure encryption and BitLocker |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | +|Configure encryption and BitLocker to protect information on your organization's devices running Windows |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | |Configure Microsoft Defender Credential Guard to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | |Configure your Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture.

You can also configure whether and what features end users can see in the Microsoft Defender Security Center. |[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center)

[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) | |Configure Microsoft Defender Application Control (also referred to as AppLocker) to choose whether to audit or trust apps on your organization's devices |[AppLocker overview](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview)
[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)
[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| From 4e6cb4fcdb3a10a47a2651f0f945ed0b70bb9040 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Jul 2020 15:35:23 -0700 Subject: [PATCH 043/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 44abfcb9c6..b5668c7654 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -57,6 +57,7 @@ The following table lists various tasks you can perform to configure Microsoft D |Configure encryption and BitLocker to protect information on your organization's devices running Windows |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | |Configure Microsoft Defender Credential Guard to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | |Configure your Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture.

You can also configure whether and what features end users can see in the Microsoft Defender Security Center. |[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center)

[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) | -|Configure Microsoft Defender Application Control (also referred to as AppLocker) to choose whether to audit or trust apps on your organization's devices |[AppLocker overview](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview)
[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)
[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| +|Configure Microsoft Defender Application Control (also referred to as AppLocker) to choose whether to audit or trust apps on your organization's devices |[AppLocker overview](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview)

[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| +| | | From 71ab632f7fbd77b5ec0354b57c3d4df758ba3d08 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 17 Jul 2020 16:21:37 -0700 Subject: [PATCH 044/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index b5668c7654..8cc7ef3d05 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -44,20 +44,20 @@ The following table lists various tasks you can perform to configure Microsoft D |Task |Resources to learn more | |---------|---------| |Manage your organization's devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | -|Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution
(for Android devices and devices running Windows 10 or later) |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | +|Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution
*(for Android devices and devices running Windows 10 or later)* |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | |Use Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | |Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus)

[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) | |If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| -|Configure your attack surface reduction rules

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | -|Configure your network filtering (this is also referred to as network protection)

*TIP: Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | +|Configure your attack surface reduction rules to target software behaviors that are often abused by attackers

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | +|Configure your network filtering block outbound connections from any app to IP addresses or domains with low reputations

*NOTES:*
- *Network filtering is also referred to as [network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection).*
- *Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | |Configure controlled folder access to protect against ransomware

*Controlled folder access is also referred to as antiransomware protection.* |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | |Configure exploit protection to protect your organization's devices from malware that uses exploits to spread and infect other devices

*Exploit protection is also referred to as Exploit Guard.* |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | |Configure Microsoft Defender SmartScreen to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings) | |Configure Microsoft Defender Firewall to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | |Configure encryption and BitLocker to protect information on your organization's devices running Windows |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | |Configure Microsoft Defender Credential Guard to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | -|Configure your Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture.

You can also configure whether and what features end users can see in the Microsoft Defender Security Center. |[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center)

[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) | -|Configure Microsoft Defender Application Control (also referred to as AppLocker) to choose whether to audit or trust apps on your organization's devices |[AppLocker overview](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview)

[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| +|Configure your Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture.

*You can also configure whether and what features end users can see in the Microsoft Defender Security Center.* |[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use)

[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center) | +|Configure Microsoft Defender Application Control to choose whether to audit or trust apps on your organization's devices

*Microsoft Defender Application Control is also referred to as [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).*|[Deploy Microsoft Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune)

[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| | | | From 494635eb0bca0fd3318c18fc3e0a0b77cfaf83c2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 07:42:15 -0700 Subject: [PATCH 045/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 8cc7ef3d05..4d377c385d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -43,21 +43,21 @@ The following table lists various tasks you can perform to configure Microsoft D |Task |Resources to learn more | |---------|---------| -|Manage your organization's devices using Intune |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | -|Integrate Microsoft Defender ATP with Microsoft Intune as a Mobile Threat Defense solution
*(for Android devices and devices running Windows 10 or later)* |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | -|Use Conditional Access to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | -|Configure your Microsoft Defender Antivirus settings using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus)

[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) | -|If necessary, specify exclusions for Microsoft Defender Antivirus

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| -|Configure your attack surface reduction rules to target software behaviors that are often abused by attackers

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | -|Configure your network filtering block outbound connections from any app to IP addresses or domains with low reputations

*NOTES:*
- *Network filtering is also referred to as [network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection).*
- *Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | -|Configure controlled folder access to protect against ransomware

*Controlled folder access is also referred to as antiransomware protection.* |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | -|Configure exploit protection to protect your organization's devices from malware that uses exploits to spread and infect other devices

*Exploit protection is also referred to as Exploit Guard.* |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | -|Configure Microsoft Defender SmartScreen to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings) | -|Configure Microsoft Defender Firewall to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | +|**Manage your organization's devices using Intune** |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | +|**Integrate Microsoft Defender ATP with Microsoft Intune** as a Mobile Threat Defense solution
*(for Android devices and devices running Windows 10 or later)* |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | +|**Use Conditional Access** to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | +|**Configure Microsoft Defender Antivirus settings** using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus)

[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) | +|**If necessary, specify exclusions for Microsoft Defender Antivirus**

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| +|**Configure your attack surface reduction rules** to target software behaviors that are often abused by attackers

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | +|**Configure your network filtering** to block outbound connections from any app to IP addresses or domains with low reputations

*NOTES:*
- *Network filtering is also referred to as [network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection).*
- *Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | +|**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | +|**Configure exploit protection** to protect your organization's devices from malware that uses exploits to spread and infect other devices

*[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection) is also referred to as Exploit Guard.* |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | +|**Configure Microsoft Defender SmartScreen** to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings) | +|**Configure Microsoft Defender Firewall** to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | |Configure encryption and BitLocker to protect information on your organization's devices running Windows |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | -|Configure Microsoft Defender Credential Guard to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | -|Configure your Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture.

*You can also configure whether and what features end users can see in the Microsoft Defender Security Center.* |[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use)

[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center) | -|Configure Microsoft Defender Application Control to choose whether to audit or trust apps on your organization's devices

*Microsoft Defender Application Control is also referred to as [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).*|[Deploy Microsoft Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune)

[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| -| | | +|**Configure Microsoft Defender Credential Guard** to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | +|**Configure your Microsoft Defender Security Center** ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture.

*You can also configure whether and what features end users can see in the Microsoft Defender Security Center.* |[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use)

[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center) | +|**Configure Microsoft Defender Application Control** to choose whether to audit or trust apps on your organization's devices

*Microsoft Defender Application Control is also referred to as [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).*|[Deploy Microsoft Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune)

[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| +|**Configure Microsoft Defender System Guard** to protect, maintain, and validate system integrity of your organization's Windows devices

*[System Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) was formerly known as Device Guard.* | | From ed4a015c259c043b81bca6ad37c95675b7a2a6bb Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 13:45:48 -0700 Subject: [PATCH 046/143] yanking 3 articles --- windows/security/threat-protection/TOC.md | 10 ++-- .../manage-atp-post-migration-mpcmdrun.md | 48 ------------------- .../manage-atp-post-migration-powershell.md | 48 ------------------- .../manage-atp-post-migration-wmi.md | 48 ------------------- 4 files changed, 4 insertions(+), 150 deletions(-) delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-mpcmdrun.md delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-powershell.md delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-wmi.md diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 396f48c2f0..e6e4f2f6f0 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -28,12 +28,10 @@ #### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md) ### [Manage Microsoft Defender ATP post migration]() #### [Overview](microsoft-defender-atp/manage-atp-post-migration.md) -#### [Use Intune](microsoft-defender-atp/manage-atp-post-migration-intune.md) -#### [Use Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md) -#### [Use PowerShell](microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md) -#### [Use Group Policy Objects](microsoft-defender-atp/manage-atp-post-migration-powershell.md) -#### [Use Windows Management Instrumentation](microsoft-defender-atp/manage-atp-post-migration-wmi.md) -#### [Use the Microsoft Malware Protection Command Line Utility](microsoft-defender-atp/manage-atp-post-migration-mpcmdrun.md) +#### [Intune](microsoft-defender-atp/manage-atp-post-migration-intune.md) +#### [Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md) +#### [Group Policy Objects](microsoft-defender-atp/manage-atp-post-migration-powershell.md) +#### [Other methods]() ## [Security administration]() ### [Threat & Vulnerability Management]() diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-mpcmdrun.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-mpcmdrun.md deleted file mode 100644 index ceb05f4934..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-mpcmdrun.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Manage Microsoft Defender ATP using Microsoft Malware Protection Command Line Utility -description: Learn how to manage Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility -keywords: post-migration, manage, operations, maintenance, utilization, Microsoft Malware Protection Command Line Utility, windows defender advanced threat protection, atp, edr -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: deniseb -author: denisebmsft -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Manage Microsoft Defender Advanced Threat Protection with Microsoft Malware Protection Command Line Utility - -We recommend using Microsoft Malware Protection Command Line Utility to manage threat protection features for the devices (also referred to as endpoints) within your organization. - -## Configuring Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility - -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility. - -|Task |Resources to learn more | -|---------|---------| -|Manage your organization's devices using Microsoft Malware Protection Command Line Utility |link | -|task |link | - - -## Find your Microsoft Defender ATP settings in Microsoft Malware Protection Command Line Utility - -> [!IMPORTANT] -> You must be a WHAT in WHERE to configure Microsoft Malware Protection Command Line Utility. To learn more, see link. - -1. Go to the where and sign in. - -2. Under what choose what. - -3. next - -4. and next - -> [!TIP] -> Need help? See link. \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-powershell.md deleted file mode 100644 index 5cc53fbc0d..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-powershell.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Manage Microsoft Defender ATP using Group Policy Objects -description: Learn how to manage Microsoft Defender ATP with Group Policy Objects -keywords: post-migration, manage, operations, maintenance, utilization, Group Policy Objects, windows defender advanced threat protection, atp, edr -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: deniseb -author: denisebmsft -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Manage Microsoft Defender Advanced Threat Protection with Group Policy Objects - -We recommend using Group Policy Objects to manage threat protection features for the devices (also referred to as endpoints) within your organization. - -## Configuring Microsoft Defender ATP with Group Policy Objects - -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Group Policy Objects. - -|Task |Resources to learn more | -|---------|---------| -|Manage your organization's devices using Group Policy Objects |link | -|task |link | - - -## Find your Microsoft Defender ATP settings in Group Policy Objects - -> [!IMPORTANT] -> You must be a WHAT in WHERE to configure Group Policy Objects. To learn more, see link. - -1. Go to the where and sign in. - -2. Under what choose what. - -3. next - -4. and next - -> [!TIP] -> Need help? See link. \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-wmi.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-wmi.md deleted file mode 100644 index 458c2c3604..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-wmi.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Manage Microsoft Defender ATP using Windows Management Instrumentation -description: Learn how to manage Microsoft Defender ATP with Windows Management Instrumentation -keywords: post-migration, manage, operations, maintenance, utilization, Windows Management Instrumentation, windows defender advanced threat protection, atp, edr -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: deniseb -author: denisebmsft -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Manage Microsoft Defender Advanced Threat Protection with Windows Management Instrumentation - -We recommend using Windows Management Instrumentation to manage threat protection features for the devices (also referred to as endpoints) within your organization. - -## Configuring Microsoft Defender ATP with Windows Management Instrumentation - -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Windows Management Instrumentation. - -|Task |Resources to learn more | -|---------|---------| -|Manage your organization's devices using Windows Management Instrumentation |link | -|task |link | - - -## Find your Microsoft Defender ATP settings in Windows Management Instrumentation - -> [!IMPORTANT] -> You must be a WHAT in WHERE to configure Windows Management Instrumentation. To learn more, see link. - -1. Go to the where and sign in. - -2. Under what choose what. - -3. next - -4. and next - -> [!TIP] -> Need help? See link. \ No newline at end of file From cb59c083aca2c0a7814338625d1d69c43ea76637 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 13:46:36 -0700 Subject: [PATCH 047/143] Create manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md new file mode 100644 index 0000000000..5cc53fbc0d --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -0,0 +1,48 @@ +--- +title: Manage Microsoft Defender ATP using Group Policy Objects +description: Learn how to manage Microsoft Defender ATP with Group Policy Objects +keywords: post-migration, manage, operations, maintenance, utilization, Group Policy Objects, windows defender advanced threat protection, atp, edr +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Manage Microsoft Defender Advanced Threat Protection with Group Policy Objects + +We recommend using Group Policy Objects to manage threat protection features for the devices (also referred to as endpoints) within your organization. + +## Configuring Microsoft Defender ATP with Group Policy Objects + +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Group Policy Objects. + +|Task |Resources to learn more | +|---------|---------| +|Manage your organization's devices using Group Policy Objects |link | +|task |link | + + +## Find your Microsoft Defender ATP settings in Group Policy Objects + +> [!IMPORTANT] +> You must be a WHAT in WHERE to configure Group Policy Objects. To learn more, see link. + +1. Go to the where and sign in. + +2. Under what choose what. + +3. next + +4. and next + +> [!TIP] +> Need help? See link. \ No newline at end of file From 0c7243c43105425ed083f3a84cd64e028b5c47f2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 13:51:51 -0700 Subject: [PATCH 048/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 32 ++++++++----------- 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 5cc53fbc0d..d84c0c1564 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -1,7 +1,7 @@ --- -title: Manage Microsoft Defender ATP using Group Policy Objects -description: Learn how to manage Microsoft Defender ATP with Group Policy Objects -keywords: post-migration, manage, operations, maintenance, utilization, Group Policy Objects, windows defender advanced threat protection, atp, edr +title: Manage Microsoft Defender ATP using PowerShell, WMI, and MPCmdRun.exe +description: Learn how to manage Microsoft Defender ATP with PowerShell, WMI, and MPCmdRun.exe +keywords: post-migration, manage, operations, maintenance, utilization, PowerShell, WMI, MPCmdRun.exe, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -17,32 +17,28 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Manage Microsoft Defender Advanced Threat Protection with Group Policy Objects +# Manage Microsoft Defender Advanced Threat Protection with PowerShell, WMI, and MPCmdRun.exe -We recommend using Group Policy Objects to manage threat protection features for the devices (also referred to as endpoints) within your organization. +We recommend using Intune to manage your threat protection features in Microsoft Defender ATP. However, you can -## Configuring Microsoft Defender ATP with Group Policy Objects +## Configuring Microsoft Defender ATP with PowerShell -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Group Policy Objects. +The following table lists various tasks you can perform to configure Microsoft Defender ATP with PowerShell. |Task |Resources to learn more | |---------|---------| -|Manage your organization's devices using Group Policy Objects |link | +|task |link | |task |link | -## Find your Microsoft Defender ATP settings in Group Policy Objects +## Configuring Microsoft Defender ATP with Windows Management Instrumentation (WMI) -> [!IMPORTANT] -> You must be a WHAT in WHERE to configure Group Policy Objects. To learn more, see link. +steps -1. Go to the where and sign in. +## Configuring Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) -2. Under what choose what. +steps -3. next +## Next steps -4. and next - -> [!TIP] -> Need help? See link. \ No newline at end of file +step From 85e76b6dd171c8de68e39ceb0d0a47c935fb9516 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 13:52:52 -0700 Subject: [PATCH 049/143] Update manage-atp-post-migration-group-policy-objects.md --- ...atp-post-migration-group-policy-objects.md | 26 ++++--------------- 1 file changed, 5 insertions(+), 21 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 715c306fdb..2a3f09a593 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -1,5 +1,5 @@ --- -title: Manage Microsoft Defender ATP using PowerShell +title: Manage Microsoft Defender ATP using Group Policy Objects description: Learn how to manage Microsoft Defender ATP with PowerShell keywords: post-migration, manage, operations, maintenance, utilization, PowerShell, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh @@ -17,32 +17,16 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Manage Microsoft Defender Advanced Threat Protection with PowerShell +# Manage Microsoft Defender Advanced Threat Protection with Group Policy Objects We recommend using PowerShell to manage threat protection features for the devices (also referred to as endpoints) within your organization. -## Configuring Microsoft Defender ATP with PowerShell +## Configuring Microsoft Defender ATP with Group Policy Objects -The following table lists various tasks you can perform to configure Microsoft Defender ATP with PowerShell. +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Group Policy Objects. |Task |Resources to learn more | |---------|---------| -|Manage your organization's devices using PowerShell |link | +|task |link | |task |link | - -## Find your Microsoft Defender ATP settings in PowerShell - -> [!IMPORTANT] -> You must be a WHAT in WHERE to configure PowerShell. To learn more, see link. - -1. Go to the where and sign in. - -2. Under what choose what. - -3. next - -4. and next - -> [!TIP] -> Need help? See link. \ No newline at end of file From 78a4b6451ca1a3292f3ae9f77e8f56fb608f3029 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 13:53:54 -0700 Subject: [PATCH 050/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index e6e4f2f6f0..a5957a45f8 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -31,7 +31,7 @@ #### [Intune](microsoft-defender-atp/manage-atp-post-migration-intune.md) #### [Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md) #### [Group Policy Objects](microsoft-defender-atp/manage-atp-post-migration-powershell.md) -#### [Other methods]() +#### [PowerShell, WMI, and MPCmdRun.exe](microsoft-defender-atp/manage-atp-post-migration-other-tools.md) ## [Security administration]() ### [Threat & Vulnerability Management]() From 1583f9267f9debaf6460d73662ac6a7356335825 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 13:57:10 -0700 Subject: [PATCH 051/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 4d377c385d..e0fb0a4344 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -54,7 +54,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Configure exploit protection** to protect your organization's devices from malware that uses exploits to spread and infect other devices

*[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection) is also referred to as Exploit Guard.* |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | |**Configure Microsoft Defender SmartScreen** to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings) | |**Configure Microsoft Defender Firewall** to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | -|Configure encryption and BitLocker to protect information on your organization's devices running Windows |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | +|**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | |**Configure Microsoft Defender Credential Guard** to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | |**Configure your Microsoft Defender Security Center** ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture.

*You can also configure whether and what features end users can see in the Microsoft Defender Security Center.* |[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use)

[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center) | |**Configure Microsoft Defender Application Control** to choose whether to audit or trust apps on your organization's devices

*Microsoft Defender Application Control is also referred to as [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).*|[Deploy Microsoft Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune)

[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| From c980980e0429b5ed69f464c4740f3c992b5b418f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 14:02:04 -0700 Subject: [PATCH 052/143] Update manage-atp-post-migration.md --- .../manage-atp-post-migration.md | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 5539fa61b5..9bcc29b90a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -22,18 +22,16 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. Use this article as a guide to getting started managing your threat protection features in Microsoft Defender ATP post migration. +After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using Intune to manage your organization's devices and security settings. However, you can use other tools/methods, such as Configuration Manager or Group Policy Objects. -Depending on what you want to configure, you can use one of several methods/tools, as listed in the following table: -| Use this tool/method... | To configure these Microsoft Defender ATP settings | -|---|---| -|Intune (part of Microsoft Endpoint Manager) |list | -| Configuration Manager (formerly System Center Configuration Manager) | | -| Group Policy Objects (in Azure Active Directory Domain Services) | | -| PowerShell (Windows, Linux, and macOS) | | -| Windows Management Instrumentation (for Windows devices only) | | -| Microsoft Malware Protection Command Line Utility (this is often referred to as *MPCmdRun.exe*) | | +|Tool/Method |Description | +|---------|---------| +|[Intune](manage-atp-post-migration-intune.md) | | +|[Configuration Manager](manage-atp-post-migration-configuration-manager.md) | | +|[Group Policy Objects](manage-atp-post-migration-group-policy-objects.md) | | +|[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md) | | + ## Additional resources From d1fbdc6221b5f62804f458a2dad10aa48af05d37 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 14:59:59 -0700 Subject: [PATCH 053/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 9bcc29b90a..c9e212b61e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -38,5 +38,5 @@ After you have moved from your previous endpoint protection and antivirus soluti |Subject | Resources | |---|---| |General resources |- Microsoft Defender Antivirus documentation ([http://aka.ms/wdavtechnet](http://aka.ms/wdavtechnet))

- Microsoft Security Intelligence ([http://www.microsoft.com/mmpc](http://www.microsoft.com/mmpc))

- Microsoft Security blog ([https://aka.ms/mmpcblog](https://aka.ms/mmpcblog)) | -|Endpoint Protection (Configuration Manager) |[Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | +|Endpoint Protection (Configuration Manager) |[Endpoint Protection documentation](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | |Test and deploy Microsoft Defender Antivirus |- | \ No newline at end of file From 27d1213a5ad004083511272dae529977be666353 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 15:34:59 -0700 Subject: [PATCH 054/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index c9e212b61e..99891582b8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -24,12 +24,14 @@ ms.topic: article After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using Intune to manage your organization's devices and security settings. However, you can use other tools/methods, such as Configuration Manager or Group Policy Objects. +The following table lists several ways to manage your Microsoft Defender ATP features and capabilities: + |Tool/Method |Description | |---------|---------| -|[Intune](manage-atp-post-migration-intune.md) | | -|[Configuration Manager](manage-atp-post-migration-configuration-manager.md) | | -|[Group Policy Objects](manage-atp-post-migration-group-policy-objects.md) | | +|[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), is a cloud-based service that focuses on mobile device management (MDM) and mobile application management (MAM). You control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | +|[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) |Configuration Manager, formerly known as System Center Configuration Manager, is a component of Microsoft Endpoint Manager. | +|[Group Policy Objects in Azure Active Directory Domain Services](manage-atp-post-migration-group-policy-objects.md) |Azure Active Directory Domain Services includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs). To learn more, see [Administer Group Policy in an Azure Active Directory Domain Services managed domain](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy). | |[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md) | | From 7b295d4e12daaa741603f0648e40e29f1525892a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 15:47:02 -0700 Subject: [PATCH 055/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 99891582b8..4725c108a3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -22,15 +22,12 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using Intune to manage your organization's devices and security settings. However, you can use other tools/methods, such as Configuration Manager or Group Policy Objects. - -The following table lists several ways to manage your Microsoft Defender ATP features and capabilities: - +After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using Intune to manage your organization's devices and security settings. However, you can use other tools/methods, such as Configuration Manager or Group Policy Objects, as listed in the following table: |Tool/Method |Description | |---------|---------| -|[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), is a cloud-based service that focuses on mobile device management (MDM) and mobile application management (MAM). You control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | -|[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) |Configuration Manager, formerly known as System Center Configuration Manager, is a component of Microsoft Endpoint Manager. | +|[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | +|[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) |Configuration Manager, formerly known as System Center Configuration Manager, is a component of Microsoft Endpoint Manager. Configuration Manager is a complex and powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | |[Group Policy Objects in Azure Active Directory Domain Services](manage-atp-post-migration-group-policy-objects.md) |Azure Active Directory Domain Services includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs). To learn more, see [Administer Group Policy in an Azure Active Directory Domain Services managed domain](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy). | |[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md) | | From f067b2f6bb73e1ff4206abd30cb2bee44f70722a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 15:48:45 -0700 Subject: [PATCH 056/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 4725c108a3..7a74afce3e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -27,7 +27,7 @@ After you have moved from your previous endpoint protection and antivirus soluti |Tool/Method |Description | |---------|---------| |[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | -|[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) |Configuration Manager, formerly known as System Center Configuration Manager, is a component of Microsoft Endpoint Manager. Configuration Manager is a complex and powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | +|[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a complex and powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | |[Group Policy Objects in Azure Active Directory Domain Services](manage-atp-post-migration-group-policy-objects.md) |Azure Active Directory Domain Services includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs). To learn more, see [Administer Group Policy in an Azure Active Directory Domain Services managed domain](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy). | |[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md) | | From f3239079fdd71dcb41c27404a1ec4866d8a43fa0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 15:51:13 -0700 Subject: [PATCH 057/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 7a74afce3e..d5749a1753 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -28,7 +28,7 @@ After you have moved from your previous endpoint protection and antivirus soluti |---------|---------| |[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | |[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a complex and powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | -|[Group Policy Objects in Azure Active Directory Domain Services](manage-atp-post-migration-group-policy-objects.md) |Azure Active Directory Domain Services includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs). To learn more, see [Administer Group Policy in an Azure Active Directory Domain Services managed domain](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy). | +|[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

[Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md) | |[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md) | | From b544f7fe420d6acd81fff9dfd3788db957b0cdc1 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:08:42 -0700 Subject: [PATCH 058/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index d5749a1753..0596300e71 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Manage Microsoft Defender Advanced Threat Protection post migration +# Manage Microsoft Defender Advanced Threat Protection, post migration **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -28,12 +28,14 @@ After you have moved from your previous endpoint protection and antivirus soluti |---------|---------| |[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | |[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a complex and powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | -|[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

[Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md) | -|[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md) | | +|[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | +|[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md) |You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configuring Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configuring Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configuring Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | ## Additional resources +The following table lists additional resources as reference materials. + |Subject | Resources | |---|---| |General resources |- Microsoft Defender Antivirus documentation ([http://aka.ms/wdavtechnet](http://aka.ms/wdavtechnet))

- Microsoft Security Intelligence ([http://www.microsoft.com/mmpc](http://www.microsoft.com/mmpc))

- Microsoft Security blog ([https://aka.ms/mmpcblog](https://aka.ms/mmpcblog)) | From 229cef52dc21c5a34797815378b6615177e47ac2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:10:34 -0700 Subject: [PATCH 059/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 0596300e71..b5b8e27e5c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -31,6 +31,7 @@ After you have moved from your previous endpoint protection and antivirus soluti |[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | |[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md) |You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configuring Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configuring Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configuring Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | +

## Additional resources From 15dec72ff8bb549185369e301aaae1ebe65c2f3e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:12:57 -0700 Subject: [PATCH 060/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index b5b8e27e5c..fcb79c0352 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -31,7 +31,7 @@ After you have moved from your previous endpoint protection and antivirus soluti |[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | |[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md) |You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configuring Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configuring Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configuring Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | -

+

## Additional resources From 878b43bc9a935a7266247ea16f66b30a6042adb2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:14:49 -0700 Subject: [PATCH 061/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index fcb79c0352..e0d0d7bb92 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -22,8 +22,8 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using Intune to manage your organization's devices and security settings. However, you can use other tools/methods, such as Configuration Manager or Group Policy Objects, as listed in the following table: - +After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using Microsoft Endpoint Manager, which includes Intune and Configuration Manager, to manage your organization's devices and security settings. However, you can use other tools/methods, such as Group Policy Objects. The following table lists various tools/methods you can use, with links to learn more. +

|Tool/Method |Description | |---------|---------| |[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | From 69fd5f5b05f9b90a0c94e9edb4e04024f1fdd442 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:16:02 -0700 Subject: [PATCH 062/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index d84c0c1564..5e27c3f2fd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -23,12 +23,8 @@ We recommend using Intune to manage your threat protection features in Microsoft ## Configuring Microsoft Defender ATP with PowerShell -The following table lists various tasks you can perform to configure Microsoft Defender ATP with PowerShell. +You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. -|Task |Resources to learn more | -|---------|---------| -|task |link | -|task |link | ## Configuring Microsoft Defender ATP with Windows Management Instrumentation (WMI) From ad15ed45eb497799a6b86f94873c23cccf300e2e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:21:51 -0700 Subject: [PATCH 063/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index e0fb0a4344..7918adc20b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -19,12 +19,12 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with Intune -We recommend using Intune to manage threat protection features for the devices (also referred to as endpoints) within your organization. +We recommend using Microsoft Intune to manage threat protection features for your organization's devices (also referred to as endpoints). Intune is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). ## Find your Microsoft Defender ATP settings in Intune > [!IMPORTANT] -> You must be a global administrator or service administrator in Intune to configure the settings described in this article. To learn more, see [Types of administrators (Intune)](https://docs.microsoft.com/mem/intune/fundamentals/users-add#types-of-administrators). +> You must be a global administrator or service administrator in Intune to configure the settings described in this article. To learn more, see **[Types of administrators (Intune)](https://docs.microsoft.com/mem/intune/fundamentals/users-add#types-of-administrators)**. 1. Go to the Azure portal ([https://portal.azure.com](https://portal.azure.com)) and sign in. @@ -35,11 +35,11 @@ We recommend using Intune to manage threat protection features for the devices ( 4. Select an existing profile, or create a new one. > [!TIP] -> Need help? See [Using Microsoft Defender ATP with Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection#example-of-using-microsoft-defender-atp-with-intune). +> Need help? See **[Using Microsoft Defender ATP with Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection#example-of-using-microsoft-defender-atp-with-intune)**. ## Configure Microsoft Defender ATP with Intune -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. You don't have to configure everything all at once; choose a task, read the corresponding resources, and proceed from there. |Task |Resources to learn more | |---------|---------| From 060713afd0b8651a6803c9039e5ea2012f839f0d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:23:16 -0700 Subject: [PATCH 064/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 7918adc20b..cf5366ae02 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -43,7 +43,7 @@ The following table lists various tasks you can perform to configure Microsoft D |Task |Resources to learn more | |---------|---------| -|**Manage your organization's devices using Intune** |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | +|**Manage your organization's devices using Intune** to protect those devices and data stored on them |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | |**Integrate Microsoft Defender ATP with Microsoft Intune** as a Mobile Threat Defense solution
*(for Android devices and devices running Windows 10 or later)* |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | |**Use Conditional Access** to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | |**Configure Microsoft Defender Antivirus settings** using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus)

[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) | From aa9a2b5cda2c958825620192a8254c7287b39a84 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:40:57 -0700 Subject: [PATCH 065/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index cf5366ae02..736518b285 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -44,12 +44,12 @@ The following table lists various tasks you can perform to configure Microsoft D |Task |Resources to learn more | |---------|---------| |**Manage your organization's devices using Intune** to protect those devices and data stored on them |[Protect devices with Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect) | -|**Integrate Microsoft Defender ATP with Microsoft Intune** as a Mobile Threat Defense solution
*(for Android devices and devices running Windows 10 or later)* |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | +|**Integrate Microsoft Defender ATP with Intune** as a Mobile Threat Defense solution
*(for Android devices and devices running Windows 10 or later)* |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | |**Use Conditional Access** to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | |**Configure Microsoft Defender Antivirus settings** using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus)

[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) | -|**If necessary, specify exclusions for Microsoft Defender Antivirus**

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| -|**Configure your attack surface reduction rules** to target software behaviors that are often abused by attackers

*TIP: Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | -|**Configure your network filtering** to block outbound connections from any app to IP addresses or domains with low reputations

*NOTES:*
- *Network filtering is also referred to as [network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection).*
- *Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | +|**If necessary, specify exclusions for Microsoft Defender Antivirus**

***Generally, you shouldn't need to apply exclusions.** Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| +|**Configure your attack surface reduction rules** to target software behaviors that are often abused by attackers

*Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | +|**Configure your network filtering** to block outbound connections from any app to IP addresses or domains with low reputations

*Network filtering is also referred to as [network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection).*

*Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | |**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | |**Configure exploit protection** to protect your organization's devices from malware that uses exploits to spread and infect other devices

*[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection) is also referred to as Exploit Guard.* |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | |**Configure Microsoft Defender SmartScreen** to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings) | @@ -58,6 +58,9 @@ The following table lists various tasks you can perform to configure Microsoft D |**Configure Microsoft Defender Credential Guard** to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | |**Configure your Microsoft Defender Security Center** ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture.

*You can also configure whether and what features end users can see in the Microsoft Defender Security Center.* |[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use)

[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center) | |**Configure Microsoft Defender Application Control** to choose whether to audit or trust apps on your organization's devices

*Microsoft Defender Application Control is also referred to as [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).*|[Deploy Microsoft Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune)

[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| -|**Configure Microsoft Defender System Guard** to protect, maintain, and validate system integrity of your organization's Windows devices

*[System Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) was formerly known as Device Guard.* | | +## Next steps +- [Get an overview of threat and vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) + +- [Visit the Microsoft Defender Security Center security operations dashboard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard) From 681bf98120fe0fd61d02a3422617651b8e843e01 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:45:12 -0700 Subject: [PATCH 066/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index e0d0d7bb92..54ece4e93c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using Microsoft Endpoint Manager, which includes Intune and Configuration Manager, to manage your organization's devices and security settings. However, you can use other tools/methods, such as Group Policy Objects. The following table lists various tools/methods you can use, with links to learn more. +After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes Intune and Configuration Manager, to manage your organization's devices and security settings. However, you can use other tools/methods, such as Group Policy Objects. The following table lists various tools/methods you can use, with links to learn more.

|Tool/Method |Description | |---------|---------| From b5c732cae0b78c09c7846dd5d703927c5c3620e5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:50:55 -0700 Subject: [PATCH 067/143] Update manage-atp-post-migration.md --- .../manage-atp-post-migration.md | 24 +++++++------------ 1 file changed, 8 insertions(+), 16 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 54ece4e93c..8a1342e109 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -22,23 +22,15 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes Intune and Configuration Manager, to manage your organization's devices and security settings. However, you can use other tools/methods, such as Group Policy Objects. The following table lists various tools/methods you can use, with links to learn more. +After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes Intune and Configuration Manager, to manage your organization's devices and security settings. However, you can use other tools/methods, such as Group Policy Objects. + +The following table lists various tools/methods you can use, with links to learn more.

+ |Tool/Method |Description | |---------|---------| -|[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | -|[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a complex and powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | -|[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | -|[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md) |You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configuring Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configuring Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configuring Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | +|**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | +|**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a complex and powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | +|**[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy)** |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | +|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configuring Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configuring Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configuring Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | -

- -## Additional resources - -The following table lists additional resources as reference materials. - -|Subject | Resources | -|---|---| -|General resources |- Microsoft Defender Antivirus documentation ([http://aka.ms/wdavtechnet](http://aka.ms/wdavtechnet))

- Microsoft Security Intelligence ([http://www.microsoft.com/mmpc](http://www.microsoft.com/mmpc))

- Microsoft Security blog ([https://aka.ms/mmpcblog](https://aka.ms/mmpcblog)) | -|Endpoint Protection (Configuration Manager) |[Endpoint Protection documentation](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | -|Test and deploy Microsoft Defender Antivirus |- | \ No newline at end of file From 5033454f558847fb3cf074330a1efe9295ebfcbb Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:54:53 -0700 Subject: [PATCH 068/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 8a1342e109..6f838c10e4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -32,5 +32,5 @@ The following table lists various tools/methods you can use, with links to learn |**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | |**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a complex and powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | |**[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy)** |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | -|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configuring Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configuring Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configuring Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configuring-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | +|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configuring Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configuring Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configuring Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | From 2334f8cb79aa2eeb9dd3d7a7f17f4344b265c593 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 20 Jul 2020 16:59:15 -0700 Subject: [PATCH 069/143] more updates --- windows/security/threat-protection/TOC.md | 2 +- ...-atp-post-migration-configuration-manager.md | 17 +---------------- .../manage-atp-post-migration-other-tools.md | 6 +++--- 3 files changed, 5 insertions(+), 20 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index a5957a45f8..72fd3c74fd 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -30,7 +30,7 @@ #### [Overview](microsoft-defender-atp/manage-atp-post-migration.md) #### [Intune](microsoft-defender-atp/manage-atp-post-migration-intune.md) #### [Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md) -#### [Group Policy Objects](microsoft-defender-atp/manage-atp-post-migration-powershell.md) +#### [Group Policy Objects](microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md) #### [PowerShell, WMI, and MPCmdRun.exe](microsoft-defender-atp/manage-atp-post-migration-other-tools.md) ## [Security administration]() diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index b6de4062b1..4ee135ecf9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -21,7 +21,7 @@ ms.topic: article We recommend using Configuration Manager to manage threat protection features for the devices (also referred to as endpoints) within your organization. -## Configuring Microsoft Defender ATP with Configuration Manager +## Configure Microsoft Defender ATP with Configuration Manager The following table lists various tasks you can perform to configure Microsoft Defender ATP with Configuration Manager. @@ -31,18 +31,3 @@ The following table lists various tasks you can perform to configure Microsoft D |task |link | -## Find your Microsoft Defender ATP settings in Configuration Manager - -> [!IMPORTANT] -> You must be a global administrator or service administrator in Configuration Manager to configure the settings described in this article. To learn more, see link. - -1. Go to the where and sign in. - -2. Under what choose what. - -3. next - -4. and next - -> [!TIP] -> Need help? See link. \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 5e27c3f2fd..a30f564442 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -21,17 +21,17 @@ ms.topic: article We recommend using Intune to manage your threat protection features in Microsoft Defender ATP. However, you can -## Configuring Microsoft Defender ATP with PowerShell +## Configure Microsoft Defender ATP with PowerShell You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. -## Configuring Microsoft Defender ATP with Windows Management Instrumentation (WMI) +## Configure Microsoft Defender ATP with Windows Management Instrumentation (WMI) steps -## Configuring Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) +## Configure Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) steps From 3bb3a424ef703c6504fe3547ebdedbf9f43fdd9f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 21 Jul 2020 08:09:03 -0700 Subject: [PATCH 070/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 23 ++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index a30f564442..f55f370783 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -19,12 +19,22 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with PowerShell, WMI, and MPCmdRun.exe -We recommend using Intune to manage your threat protection features in Microsoft Defender ATP. However, you can +We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection), to manage your organization's threat protection features in Microsoft Defender ATP. However, you can use PowerShell, Windows Management Instrumentation (WMI), and the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to perform some tasks, such as managing Microsoft Defender Antivirus. + ## Configure Microsoft Defender ATP with PowerShell You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. +> [!NOTE] +> PowerShell cmdlets should not be used as a replacement for a full network policy management infrastructure, such as [Configuration Manager](https://docs.microsoft.com/configmgr), [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), or [Microsoft Defender Antivirus Group Policy ADMX templates](https://www.microsoft.com/download/101445). Changes made with PowerShell will affect local settings on the device where the changes are deployed or made. Policies that are deployed using Group Policy, Configuration Manager, or Intune can overwrite changes made with PowerShell. + + +|Task |Resources to learn more | +|---------|---------| +|Manage Microsoft Defender Antivirus |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus) | +|Configure exploit protection | | +|Configure attack surface reduction rules | | ## Configure Microsoft Defender ATP with Windows Management Instrumentation (WMI) @@ -33,8 +43,15 @@ steps ## Configure Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) -steps + +|Task |Resources to learn more | +|---------|---------| +|Manage Microsoft Defender Antivirus |[Configure and manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line tool](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) | +|Row2 | | + ## Next steps -step +- [Get an overview of threat and vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) + +- [Visit the Microsoft Defender Security Center security operations dashboard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard) From defe69da2b2d45d0d93506d007095b03d87e5e17 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 21 Jul 2020 08:10:43 -0700 Subject: [PATCH 071/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index f55f370783..4d050a3712 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -19,17 +19,13 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with PowerShell, WMI, and MPCmdRun.exe -We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection), to manage your organization's threat protection features in Microsoft Defender ATP. However, you can use PowerShell, Windows Management Instrumentation (WMI), and the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to perform some tasks, such as managing Microsoft Defender Antivirus. +We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection), to manage your organization's threat protection features in Microsoft Defender ATP. However, you can use PowerShell, Windows Management Instrumentation (WMI), and the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to perform some tasks, such as managing Microsoft Defender Antivirus, or configuring some settings on a device. ## Configure Microsoft Defender ATP with PowerShell You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. -> [!NOTE] -> PowerShell cmdlets should not be used as a replacement for a full network policy management infrastructure, such as [Configuration Manager](https://docs.microsoft.com/configmgr), [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), or [Microsoft Defender Antivirus Group Policy ADMX templates](https://www.microsoft.com/download/101445). Changes made with PowerShell will affect local settings on the device where the changes are deployed or made. Policies that are deployed using Group Policy, Configuration Manager, or Intune can overwrite changes made with PowerShell. - - |Task |Resources to learn more | |---------|---------| |Manage Microsoft Defender Antivirus |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus) | From cfe4a4013fe992bcf87c1609bbc54255b12b4c33 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 21 Jul 2020 10:38:33 -0700 Subject: [PATCH 072/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 4d050a3712..e8d3196450 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -42,7 +42,7 @@ steps |Task |Resources to learn more | |---------|---------| -|Manage Microsoft Defender Antivirus |[Configure and manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line tool](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) | +|Manage Microsoft Defender Antivirus |[Configure and manage Microsoft Defender Antivirus with the Microsoft Malware Protection Command Line Utility (mpcmdrun.exe) command-line tool](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) | |Row2 | | From 65ccd59b03cccfc879682bed905066b675a461d1 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 21 Jul 2020 13:42:06 -0700 Subject: [PATCH 073/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 4ee135ecf9..ab31627d83 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -27,7 +27,7 @@ The following table lists various tasks you can perform to configure Microsoft D |Task |Resources to learn more | |---------|---------| -|Manage your organization's devices using Configuration Manager |link | +|Manage your organization's devices using Configuration Manager |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | |task |link | From 0f658b2c3c5581133bfaa192d733d80befb44cf3 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 21 Jul 2020 13:54:00 -0700 Subject: [PATCH 074/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index ab31627d83..64afa8a6df 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -27,7 +27,7 @@ The following table lists various tasks you can perform to configure Microsoft D |Task |Resources to learn more | |---------|---------| -|Manage your organization's devices using Configuration Manager |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | +|Manage your organization's devices using Configuration Manager

|[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection)

[Onboarding to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | |task |link | From 565160cc9b883e9a503b5bd86098c0e8e76d054e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 21 Jul 2020 14:20:13 -0700 Subject: [PATCH 075/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 64afa8a6df..5890d7e96a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -19,7 +19,11 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with Configuration Manager -We recommend using Configuration Manager to manage threat protection features for the devices (also referred to as endpoints) within your organization. +You can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage your organization's threat protection features for devices (also referred to as endpoints) within your organization. Configuration Manager is part of Microsoft Endpoint Manager, along with Intune, Desktop Analytics, and other features and capabilities. [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). + +## Find your Microsoft Defender ATP settings in Configuration Manager + +1. ## Configure Microsoft Defender ATP with Configuration Manager From 962f1cb5f08648132ab9af76aa45f00ab3bd1919 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 22 Jul 2020 14:01:23 -0700 Subject: [PATCH 076/143] intro updates --- .../manage-atp-post-migration-configuration-manager.md | 2 +- .../manage-atp-post-migration-intune.md | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 5890d7e96a..8f15c5d09a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -19,7 +19,7 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with Configuration Manager -You can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage your organization's threat protection features for devices (also referred to as endpoints) within your organization. Configuration Manager is part of Microsoft Endpoint Manager, along with Intune, Desktop Analytics, and other features and capabilities. [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). +You can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage your organization's threat protection features for devices (also referred to as endpoints). Configuration Manager is part of Microsoft Endpoint Manager, along with Intune, Desktop Analytics, and other features & capabilities. [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). ## Find your Microsoft Defender ATP settings in Configuration Manager diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 736518b285..1db92d85dc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -19,7 +19,10 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with Intune -We recommend using Microsoft Intune to manage threat protection features for your organization's devices (also referred to as endpoints). Intune is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). +We recommend using Microsoft Intune to manage your organization's threat protection features for devices (also referred to as endpoints). Intune is part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), along with Configuration Manager, Desktop Analytics, and other features & capabilities. + +You can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage your organization's threat protection features for devices (also referred to as endpoints) within your organization. Configuration Manager is part of Microsoft Endpoint Manager, along with Intune, Desktop Analytics, and other features and capabilities. [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). + ## Find your Microsoft Defender ATP settings in Intune From 786ed3697eb1ded8b58f992ad5a65610d3849cf6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 22 Jul 2020 17:01:17 -0700 Subject: [PATCH 077/143] more fixes and additions --- ...ge-atp-post-migration-configuration-manager.md | 15 +++++++++++---- ...age-atp-post-migration-group-policy-objects.md | 3 +++ .../manage-atp-post-migration-intune.md | 9 +++++---- .../manage-atp-post-migration-other-tools.md | 3 +++ 4 files changed, 22 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 8f15c5d09a..68b51fc554 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -19,19 +19,26 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with Configuration Manager -You can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage your organization's threat protection features for devices (also referred to as endpoints). Configuration Manager is part of Microsoft Endpoint Manager, along with Intune, Desktop Analytics, and other features & capabilities. [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -## Find your Microsoft Defender ATP settings in Configuration Manager +You can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage threat protection features for your organization's devices (also referred to as endpoints). In fact, Configuration Manager and Microsoft Intune are both part of Microsoft Endpoint Manager, together with Desktop Analytics, and other features & capabilities. This means that you can use *either* Configuration Manager or Intune, or both to manage Microsoft Defender ATP. -1. +- [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) +- [See how you can manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) ## Configure Microsoft Defender ATP with Configuration Manager -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Configuration Manager. +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. You don't have to configure everything all at once; choose a task, read the corresponding resources, and then proceed from there, at your pace. + |Task |Resources to learn more | |---------|---------| |Manage your organization's devices using Configuration Manager

|[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection)

[Onboarding to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | |task |link | +## Related articles +[Manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) + +## Next steps diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 2a3f09a593..68c12f8a37 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -19,6 +19,9 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with Group Policy Objects +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + We recommend using PowerShell to manage threat protection features for the devices (also referred to as endpoints) within your organization. ## Configuring Microsoft Defender ATP with Group Policy Objects diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 1db92d85dc..9cfa77689d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -19,9 +19,10 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with Intune -We recommend using Microsoft Intune to manage your organization's threat protection features for devices (also referred to as endpoints). Intune is part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), along with Configuration Manager, Desktop Analytics, and other features & capabilities. +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -You can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage your organization's threat protection features for devices (also referred to as endpoints) within your organization. Configuration Manager is part of Microsoft Endpoint Manager, along with Intune, Desktop Analytics, and other features and capabilities. [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). +We recommend using Microsoft Intune to manage your organization's threat protection features for devices (also referred to as endpoints). Intune is part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), along with Configuration Manager, Desktop Analytics, and other features & capabilities. [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). ## Find your Microsoft Defender ATP settings in Intune @@ -42,7 +43,7 @@ You can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/cor ## Configure Microsoft Defender ATP with Intune -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. You don't have to configure everything all at once; choose a task, read the corresponding resources, and proceed from there. +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. You don't have to configure everything all at once; choose a task, read the corresponding resources, and then proceed from there, at your pace. |Task |Resources to learn more | |---------|---------| @@ -50,7 +51,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Integrate Microsoft Defender ATP with Intune** as a Mobile Threat Defense solution
*(for Android devices and devices running Windows 10 or later)* |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | |**Use Conditional Access** to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | |**Configure Microsoft Defender Antivirus settings** using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus)

[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) | -|**If necessary, specify exclusions for Microsoft Defender Antivirus**

***Generally, you shouldn't need to apply exclusions.** Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| +|**If necessary, specify exclusions for Microsoft Defender Antivirus**

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| |**Configure your attack surface reduction rules** to target software behaviors that are often abused by attackers

*Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | |**Configure your network filtering** to block outbound connections from any app to IP addresses or domains with low reputations

*Network filtering is also referred to as [network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection).*

*Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | |**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index e8d3196450..f1016108d4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -19,6 +19,9 @@ ms.topic: article # Manage Microsoft Defender Advanced Threat Protection with PowerShell, WMI, and MPCmdRun.exe +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection), to manage your organization's threat protection features in Microsoft Defender ATP. However, you can use PowerShell, Windows Management Instrumentation (WMI), and the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to perform some tasks, such as managing Microsoft Defender Antivirus, or configuring some settings on a device. From 2a5105099e76c1b08aa85dcb371397fdbcfa73eb Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 22 Jul 2020 17:11:31 -0700 Subject: [PATCH 078/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index f1016108d4..045bca7db0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -22,8 +22,14 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection), to manage your organization's threat protection features in Microsoft Defender ATP. However, you can use PowerShell, Windows Management Instrumentation (WMI), and the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to perform some tasks, such as managing Microsoft Defender Antivirus, or configuring some settings on a device. +When it comes to managing your organization's threat protection features in Microsoft Defender ATP, we recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection). To learn more, see the following articles: +- [Manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) +- [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md) +You can, however, use other tools/methods to perform some tasks, such as managing Microsoft Defender Antivirus settings. These tools/methods include: +- [PowerShell](#configure-microsoft-defender-atp-with-powershell) +- [Windows Management Instrumentation](#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi) (WMI) +- [The Microsoft Malware Protection Command Line Utility](#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe) (MPCmdRun.exe) ## Configure Microsoft Defender ATP with PowerShell From 6cfaa63fb771590052cd9cc73e38f0471b8c966b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 22 Jul 2020 17:29:39 -0700 Subject: [PATCH 079/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 68b51fc554..c34c280c0d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -22,14 +22,13 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -You can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage threat protection features for your organization's devices (also referred to as endpoints). In fact, Configuration Manager and Microsoft Intune are both part of Microsoft Endpoint Manager, together with Desktop Analytics, and other features & capabilities. This means that you can use *either* Configuration Manager or Intune, or both to manage Microsoft Defender ATP. - +We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage Microsoft Defender ATP settings. Configuration Manager and Microsoft Intune are both part of Microsoft Endpoint Manager, together with Desktop Analytics, and other features & capabilities. - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) - [See how you can manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) ## Configure Microsoft Defender ATP with Configuration Manager -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. You don't have to configure everything all at once; choose a task, read the corresponding resources, and then proceed from there, at your pace. +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. Choose a task, read the corresponding resources, and then proceed from there, at your pace. |Task |Resources to learn more | From b38905a9f6bbae0c8d9bff7f2ae4eab803aae5c5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 22 Jul 2020 17:37:37 -0700 Subject: [PATCH 080/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index c34c280c0d..09fb124b18 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage Microsoft Defender ATP settings. Configuration Manager and Microsoft Intune are both part of Microsoft Endpoint Manager, together with Desktop Analytics, and other features & capabilities. +We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage Microsoft Defender ATP. Configuration Manager and Microsoft Intune are both part of Microsoft Endpoint Manager, together with Desktop Analytics, and other features & capabilities. - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) - [See how you can manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) From b44124d110f3dfb9b1b6ddb17076766c29c2f016 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 08:05:53 -0700 Subject: [PATCH 081/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 09fb124b18..9652006b5f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -24,7 +24,7 @@ ms.topic: article We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage Microsoft Defender ATP. Configuration Manager and Microsoft Intune are both part of Microsoft Endpoint Manager, together with Desktop Analytics, and other features & capabilities. - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) -- [See how you can manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) +- [Co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) ## Configure Microsoft Defender ATP with Configuration Manager From 7fa558f95599b1c99f01c3dfc768ec2eb9c01318 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 08:11:45 -0700 Subject: [PATCH 082/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 9652006b5f..e2a6164549 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -28,13 +28,11 @@ We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fund ## Configure Microsoft Defender ATP with Configuration Manager -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. Choose a task, read the corresponding resources, and then proceed from there, at your pace. - - |Task |Resources to learn more | |---------|---------| +|Install the Configuration Manager console |[Get the installation media](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/get-install-media)

[Install the Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/install-consoles) | |Manage your organization's devices using Configuration Manager

|[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection)

[Onboarding to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | -|task |link | +|manages antimalware policies and Windows Firewall security for client computers |link | ## Related articles From 9d652ff975461aba717f0f2d942674b3ddbd962f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 08:32:47 -0700 Subject: [PATCH 083/143] Update manage-atp-post-migration-configuration-manager.md --- ...age-atp-post-migration-configuration-manager.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index e2a6164549..ca4bee2557 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -31,11 +31,13 @@ We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fund |Task |Resources to learn more | |---------|---------| |Install the Configuration Manager console |[Get the installation media](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/get-install-media)

[Install the Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/install-consoles) | -|Manage your organization's devices using Configuration Manager

|[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection)

[Onboarding to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | -|manages antimalware policies and Windows Firewall security for client computers |link | - -## Related articles - -[Manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) +|Manage your organization's devices using Configuration Manager

|[Onboarding to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | +|Manage antimalware policies and Windows Firewall security for client computers |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | ## Next steps + +- [Get an overview of threat and vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) + +- [Visit the Microsoft Defender Security Center security operations dashboard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard) + +- [Manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) From 0491cd8ee5b878e39d0a5392dedba3faa91ca1a8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 08:37:02 -0700 Subject: [PATCH 084/143] more updates/fixes --- .../manage-atp-post-migration-configuration-manager.md | 2 +- .../manage-atp-post-migration-group-policy-objects.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index ca4bee2557..fae1ba5590 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage Microsoft Defender ATP. Configuration Manager and Microsoft Intune are both part of Microsoft Endpoint Manager, together with Desktop Analytics, and other features & capabilities. +We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage Microsoft Defender ATP. Both Configuration Manager and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), together with Desktop Analytics, and other features & capabilities. - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) - [Co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 68c12f8a37..3cf71e593d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using PowerShell to manage threat protection features for the devices (also referred to as endpoints) within your organization. +We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use Group Policy Objects in Azure Active Directory Domain Services. ## Configuring Microsoft Defender ATP with Group Policy Objects From a3fc05a7eb3014f533fc60570182883dd07d157b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 08:37:37 -0700 Subject: [PATCH 085/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 9cfa77689d..db8a36ec1c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using Microsoft Intune to manage your organization's threat protection features for devices (also referred to as endpoints). Intune is part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), along with Configuration Manager, Desktop Analytics, and other features & capabilities. [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). +We recommend using Microsoft Intune to manage your organization's threat protection features for devices (also referred to as endpoints). Intune is part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Configuration Manager, Desktop Analytics, and other features & capabilities. [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). ## Find your Microsoft Defender ATP settings in Intune From 7d0988c84890a3ce5dce6d1978faf3df794a5e8e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 08:55:45 -0700 Subject: [PATCH 086/143] more meat to the guide --- ...anage-atp-post-migration-configuration-manager.md | 2 +- ...manage-atp-post-migration-group-policy-objects.md | 12 ++++++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index fae1ba5590..9e5ff22dc2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -31,7 +31,7 @@ We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fund |Task |Resources to learn more | |---------|---------| |Install the Configuration Manager console |[Get the installation media](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/get-install-media)

[Install the Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/install-consoles) | -|Manage your organization's devices using Configuration Manager

|[Onboarding to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | +|Manage your organization's devices using Configuration Manager

|[Onboard to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | |Manage antimalware policies and Windows Firewall security for client computers |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | ## Next steps diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 3cf71e593d..45114879b9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -30,6 +30,14 @@ The following table lists various tasks you can perform to configure Microsoft D |Task |Resources to learn more | |---------|---------| -|task |link | -|task |link | +|**Manage settings for user and computer objects**

*Customize built-in Group Policy Objects, or create custom Group Policy Objects and organizational units to suit your organizational needs.* |[Administer Group Policy in an Azure Active Directory Domain Services managed domain](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) | +|**Configure Microsoft Defender Antivirus**

*Configure antivirus features & capabilities, including policy settings, exclusions, remediation, and scheduled scans on your organization's devices (also referred to as endpoints).* |[Use Group Policy settings to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus) | +|**Manage your organization's attack surface reduction rules**

*Customize your attack surface reduction rules by excluding files & folders, or by adding custom text to notification alerts that appear on a users' devices.* |[Customize attack surface reduction rules with Group Policy Objects](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-group-policy-to-exclude-files-and-folders) | +## Next steps + +- [Get an overview of threat and vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) + +- [Visit the Microsoft Defender Security Center security operations dashboard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard) + +- [Manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) From 8a79ee1c7561187e94dfccb573825b4f9f474af5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 09:05:50 -0700 Subject: [PATCH 087/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 045bca7db0..fcb13b1db5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -31,6 +31,9 @@ You can, however, use other tools/methods to perform some tasks, such as managin - [Windows Management Instrumentation](#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi) (WMI) - [The Microsoft Malware Protection Command Line Utility](#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe) (MPCmdRun.exe) +> [!NOTE] +> Threat protection features that you configure by using PowerShell, WMI, or MCPmdRun.exe can be overwritten by configuration settings that are deployed with Intune or Configuration Manager. + ## Configure Microsoft Defender ATP with PowerShell You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. @@ -38,8 +41,8 @@ You can use PowerShell to manage Microsoft Defender Antivirus, exploit protectio |Task |Resources to learn more | |---------|---------| |Manage Microsoft Defender Antivirus |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus) | -|Configure exploit protection | | -|Configure attack surface reduction rules | | +|Configure exploit protection | [Customize exploit protection: PowerShell reference](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection#powershell-reference) | +|Configure attack surface reduction rules

*You can use PowerShell to exclude files and folders from attack surface reduction rules.* |[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-powershell-to-exclude-files-and-folders) | ## Configure Microsoft Defender ATP with Windows Management Instrumentation (WMI) @@ -60,3 +63,5 @@ steps - [Get an overview of threat and vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) - [Visit the Microsoft Defender Security Center security operations dashboard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard) + +- [Manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) From dea940404a1030eebde2941a07ff9863773e37ff Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 09:09:42 -0700 Subject: [PATCH 088/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index fcb13b1db5..540d4567f0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -26,10 +26,7 @@ When it comes to managing your organization's threat protection features in Micr - [Manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) - [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md) -You can, however, use other tools/methods to perform some tasks, such as managing Microsoft Defender Antivirus settings. These tools/methods include: -- [PowerShell](#configure-microsoft-defender-atp-with-powershell) -- [Windows Management Instrumentation](#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi) (WMI) -- [The Microsoft Malware Protection Command Line Utility](#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe) (MPCmdRun.exe) +You can, however, use other tools/methods to perform some tasks. Examples include managing Microsoft Defender Antivirus settings and customizing attack surface reduction rules. These other tools/methods include [PowerShell](#configure-microsoft-defender-atp-with-powershell), [Windows Management Instrumentation](#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi) (WMI), and [The Microsoft Malware Protection Command Line Utility](#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe) (MPCmdRun.exe). > [!NOTE] > Threat protection features that you configure by using PowerShell, WMI, or MCPmdRun.exe can be overwritten by configuration settings that are deployed with Intune or Configuration Manager. From a704ad35c8eb1ce2d24019ff1bad34c7f02fb9d6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 09:26:39 -0700 Subject: [PATCH 089/143] continuing work on the guide --- ...-atp-post-migration-configuration-manager.md | 6 +++--- .../manage-atp-post-migration-other-tools.md | 17 +++++++++++------ 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 9e5ff22dc2..e88562413c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -30,9 +30,9 @@ We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fund |Task |Resources to learn more | |---------|---------| -|Install the Configuration Manager console |[Get the installation media](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/get-install-media)

[Install the Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/install-consoles) | -|Manage your organization's devices using Configuration Manager

|[Onboard to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | -|Manage antimalware policies and Windows Firewall security for client computers |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | +|**Install the Configuration Manager console** |[Get the installation media](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/get-install-media)

[Install the Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/install-consoles) | +|**Manage your organization's devices using Configuration Manager**

|[Onboard to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | +|**Manage antimalware policies and Windows Firewall security for client computers** |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | ## Next steps diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 540d4567f0..d6c7dab5ec 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -37,22 +37,27 @@ You can use PowerShell to manage Microsoft Defender Antivirus, exploit protectio |Task |Resources to learn more | |---------|---------| -|Manage Microsoft Defender Antivirus |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus) | -|Configure exploit protection | [Customize exploit protection: PowerShell reference](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection#powershell-reference) | -|Configure attack surface reduction rules

*You can use PowerShell to exclude files and folders from attack surface reduction rules.* |[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-powershell-to-exclude-files-and-folders) | +|**Manage Microsoft Defender Antivirus** |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus) | +|**Configure exploit protection** | [Customize exploit protection: PowerShell reference](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection#powershell-reference) | +|**Configure attack surface reduction rules**

*You can use PowerShell to exclude files and folders from attack surface reduction rules.* |[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-powershell-to-exclude-files-and-folders) | ## Configure Microsoft Defender ATP with Windows Management Instrumentation (WMI) -steps + +|Task |Resources to learn more | +|---------|---------| +|task 1 | link | +|task 2 | link | + ## Configure Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) |Task |Resources to learn more | |---------|---------| -|Manage Microsoft Defender Antivirus |[Configure and manage Microsoft Defender Antivirus with the Microsoft Malware Protection Command Line Utility (mpcmdrun.exe) command-line tool](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) | -|Row2 | | +|**Manage Microsoft Defender Antivirus** |[Configure and manage Microsoft Defender Antivirus with the Microsoft Malware Protection Command Line Utility (mpcmdrun.exe) command-line tool](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) | +|Row2 | link | ## Next steps From 988a30c9364b941117e5d56b5fd8c4b6db75986c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 15:13:54 -0700 Subject: [PATCH 090/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index e88562413c..fa7c07ee31 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -31,7 +31,7 @@ We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fund |Task |Resources to learn more | |---------|---------| |**Install the Configuration Manager console** |[Get the installation media](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/get-install-media)

[Install the Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/install-consoles) | -|**Manage your organization's devices using Configuration Manager**

|[Onboard to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | +|**Manage your organization's devices using Configuration Manager**

*If you have devices (or endpoints) not already onboarded to Microsoft Defender ATP, you can do that with Configuration Manager.* |[Onboard to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | |**Manage antimalware policies and Windows Firewall security for client computers** |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | ## Next steps From f3dd1cdd0ae03a07f592fb2172ec048539aabd2b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 15:17:20 -0700 Subject: [PATCH 091/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index fa7c07ee31..e7fb66b1a2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -30,9 +30,9 @@ We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fund |Task |Resources to learn more | |---------|---------| -|**Install the Configuration Manager console** |[Get the installation media](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/get-install-media)

[Install the Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/install-consoles) | +|**Install the Configuration Manager console**

*If you don't already have the Configuration Manger console, use these resources to get the bits and install it.* |[Get the installation media](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/get-install-media)

[Install the Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/install-consoles) | |**Manage your organization's devices using Configuration Manager**

*If you have devices (or endpoints) not already onboarded to Microsoft Defender ATP, you can do that with Configuration Manager.* |[Onboard to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | -|**Manage antimalware policies and Windows Firewall security for client computers** |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | +|**Manage antimalware policies and Windows Firewall security for client computers**

*Configure endpoint protection features, including Microsoft Defender ATP, exploit protection, application control, antimalware, firewall settings, and more.* |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | ## Next steps From 46cea2df42597ea6256cc7f9f0482e848e2e89d5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 15:26:54 -0700 Subject: [PATCH 092/143] Update manage-atp-post-migration-group-policy-objects.md --- .../manage-atp-post-migration-group-policy-objects.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 45114879b9..a66a772f93 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -33,6 +33,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Manage settings for user and computer objects**

*Customize built-in Group Policy Objects, or create custom Group Policy Objects and organizational units to suit your organizational needs.* |[Administer Group Policy in an Azure Active Directory Domain Services managed domain](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) | |**Configure Microsoft Defender Antivirus**

*Configure antivirus features & capabilities, including policy settings, exclusions, remediation, and scheduled scans on your organization's devices (also referred to as endpoints).* |[Use Group Policy settings to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus) | |**Manage your organization's attack surface reduction rules**

*Customize your attack surface reduction rules by excluding files & folders, or by adding custom text to notification alerts that appear on a users' devices.* |[Customize attack surface reduction rules with Group Policy Objects](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-group-policy-to-exclude-files-and-folders) | +|** |[Customize exploit protection settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[Import, export, and deploy exploit protection configurations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml)

[Use Group Policy to distribute the configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml#use-group-policy-to-distribute-the-configuration) | ## Next steps From 76466b4aa122212390a5dba5a396ae82dd797a00 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 15:30:16 -0700 Subject: [PATCH 093/143] Update manage-atp-post-migration-group-policy-objects.md --- .../manage-atp-post-migration-group-policy-objects.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index a66a772f93..63d67801b3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -33,7 +33,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Manage settings for user and computer objects**

*Customize built-in Group Policy Objects, or create custom Group Policy Objects and organizational units to suit your organizational needs.* |[Administer Group Policy in an Azure Active Directory Domain Services managed domain](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) | |**Configure Microsoft Defender Antivirus**

*Configure antivirus features & capabilities, including policy settings, exclusions, remediation, and scheduled scans on your organization's devices (also referred to as endpoints).* |[Use Group Policy settings to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus) | |**Manage your organization's attack surface reduction rules**

*Customize your attack surface reduction rules by excluding files & folders, or by adding custom text to notification alerts that appear on a users' devices.* |[Customize attack surface reduction rules with Group Policy Objects](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-group-policy-to-exclude-files-and-folders) | -|** |[Customize exploit protection settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[Import, export, and deploy exploit protection configurations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml)

[Use Group Policy to distribute the configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml#use-group-policy-to-distribute-the-configuration) | +|**Manage exploit protection settings**

*You can customize your exploit protection settings, import a configuration file, and then use Group Policy to deploy that configuration file.* |[Customize exploit protection settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[Import, export, and deploy exploit protection configurations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml)

[Use Group Policy to distribute the configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml#use-group-policy-to-distribute-the-configuration) | ## Next steps From 4e2f40310a57b542fba76f6a34193d34f7c1dcd8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 15:35:15 -0700 Subject: [PATCH 094/143] Update manage-atp-post-migration-group-policy-objects.md --- .../manage-atp-post-migration-group-policy-objects.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 63d67801b3..2ad606801d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -31,7 +31,7 @@ The following table lists various tasks you can perform to configure Microsoft D |Task |Resources to learn more | |---------|---------| |**Manage settings for user and computer objects**

*Customize built-in Group Policy Objects, or create custom Group Policy Objects and organizational units to suit your organizational needs.* |[Administer Group Policy in an Azure Active Directory Domain Services managed domain](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) | -|**Configure Microsoft Defender Antivirus**

*Configure antivirus features & capabilities, including policy settings, exclusions, remediation, and scheduled scans on your organization's devices (also referred to as endpoints).* |[Use Group Policy settings to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus) | +|**Configure Microsoft Defender Antivirus**

*Configure antivirus features & capabilities, including policy settings, exclusions, remediation, and scheduled scans on your organization's devices (also referred to as endpoints).* |[Use Group Policy settings to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus)

[Use Group Policy to enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-group-policy-to-enable-cloud-delivered-protection) | |**Manage your organization's attack surface reduction rules**

*Customize your attack surface reduction rules by excluding files & folders, or by adding custom text to notification alerts that appear on a users' devices.* |[Customize attack surface reduction rules with Group Policy Objects](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-group-policy-to-exclude-files-and-folders) | |**Manage exploit protection settings**

*You can customize your exploit protection settings, import a configuration file, and then use Group Policy to deploy that configuration file.* |[Customize exploit protection settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[Import, export, and deploy exploit protection configurations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml)

[Use Group Policy to distribute the configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml#use-group-policy-to-distribute-the-configuration) | From 1ac43ef6fbdc71599d42ec806c46bd12df5d1f3a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 23 Jul 2020 15:37:30 -0700 Subject: [PATCH 095/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index d6c7dab5ec..c1a8838634 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -37,17 +37,16 @@ You can use PowerShell to manage Microsoft Defender Antivirus, exploit protectio |Task |Resources to learn more | |---------|---------| -|**Manage Microsoft Defender Antivirus** |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus) | -|**Configure exploit protection** | [Customize exploit protection: PowerShell reference](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection#powershell-reference) | -|**Configure attack surface reduction rules**

*You can use PowerShell to exclude files and folders from attack surface reduction rules.* |[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-powershell-to-exclude-files-and-folders) | +|**Manage Microsoft Defender Antivirus** with PowerShell cmdlets |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus)

[Use PowerShell cmdlets to enable cloud-delivered protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-powershell-cmdlets-to-enable-cloud-delivered-protection) | +|**Configure exploit protection** with PowerShell | [Customize exploit protection: PowerShell reference](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection#powershell-reference) | +|**Configure attack surface reduction rules** with PowerShell

*You can use PowerShell to exclude files and folders from attack surface reduction rules.* |[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-powershell-to-exclude-files-and-folders) | ## Configure Microsoft Defender ATP with Windows Management Instrumentation (WMI) - |Task |Resources to learn more | |---------|---------| -|task 1 | link | +|**Enable cloud-delivered protection** |[Use Windows Management Instruction (WMI) to enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-windows-management-instruction-wmi-to-enable-cloud-delivered-protection) | |task 2 | link | From 97e20d5c00b1b7052cee317e5347e109e800d629 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 14:34:17 -0700 Subject: [PATCH 096/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index e7fb66b1a2..d9cf44d22f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -33,6 +33,7 @@ We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fund |**Install the Configuration Manager console**

*If you don't already have the Configuration Manger console, use these resources to get the bits and install it.* |[Get the installation media](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/get-install-media)

[Install the Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/install-consoles) | |**Manage your organization's devices using Configuration Manager**

*If you have devices (or endpoints) not already onboarded to Microsoft Defender ATP, you can do that with Configuration Manager.* |[Onboard to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | |**Manage antimalware policies and Windows Firewall security for client computers**

*Configure endpoint protection features, including Microsoft Defender ATP, exploit protection, application control, antimalware, firewall settings, and more.* |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | +|**Choose methods for updating antimalware updates** on your organization's devices

*With Endpoint Protection in Configuration Manager, you can choose from several methods to keep antimalware definitions up to date on your organization's devices.* |[Configure definition updates for Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definition-updates)

[Use Configuration Manager to deliver definition updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-configmgr) | ## Next steps From 03316370bfce30e835523bf93e956fcef59a2a10 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 15:01:18 -0700 Subject: [PATCH 097/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index d9cf44d22f..546889a27c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -30,9 +30,9 @@ We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fund |Task |Resources to learn more | |---------|---------| -|**Install the Configuration Manager console**

*If you don't already have the Configuration Manger console, use these resources to get the bits and install it.* |[Get the installation media](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/get-install-media)

[Install the Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/install-consoles) | -|**Manage your organization's devices using Configuration Manager**

*If you have devices (or endpoints) not already onboarded to Microsoft Defender ATP, you can do that with Configuration Manager.* |[Onboard to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | -|**Manage antimalware policies and Windows Firewall security for client computers**

*Configure endpoint protection features, including Microsoft Defender ATP, exploit protection, application control, antimalware, firewall settings, and more.* |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | +|**Install the Configuration Manager console** if you don't already have it

*If you don't already have the Configuration Manger console, use these resources to get the bits and install it.* |[Get the installation media](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/get-install-media)

[Install the Configuration Manager console](https://docs.microsoft.com/mem/configmgr/core/servers/deploy/install/install-consoles) | +|**Use Configuration Manager to onboard devices** to Microsoft Defender ATP

*If you have devices (or endpoints) not already onboarded to Microsoft Defender ATP, you can do that with Configuration Manager.* |[Onboard to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | +|**Manage antimalware policies and Windows Firewall security** for client computers (endpoints)

*Configure endpoint protection features, including Microsoft Defender ATP, exploit protection, application control, antimalware, firewall settings, and more.* |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | |**Choose methods for updating antimalware updates** on your organization's devices

*With Endpoint Protection in Configuration Manager, you can choose from several methods to keep antimalware definitions up to date on your organization's devices.* |[Configure definition updates for Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definition-updates)

[Use Configuration Manager to deliver definition updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-configmgr) | ## Next steps From 975a2c80ef148dec64e2850bd3a5d13420f76591 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 15:09:38 -0700 Subject: [PATCH 098/143] more content adds/fixes --- .../manage-atp-post-migration-configuration-manager.md | 6 ++++-- .../manage-atp-post-migration-group-policy-objects.md | 4 ++-- .../manage-atp-post-migration-other-tools.md | 6 +++--- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 546889a27c..79850d79fb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -22,9 +22,11 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage Microsoft Defender ATP. Both Configuration Manager and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), together with Desktop Analytics, and other features & capabilities. +We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage some settings in Microsoft Defender ATP. + +Both Configuration Manager and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Desktop Analytics, and other features & capabilities. - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) -- [Co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) +- [See how you can co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) ## Configure Microsoft Defender ATP with Configuration Manager diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 2ad606801d..87fb13aa5b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -22,9 +22,9 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use Group Policy Objects in Azure Active Directory Domain Services. +We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use Group Policy Objects in Azure Active Directory Domain Services to manage some settings in Microsoft Defender ATP. -## Configuring Microsoft Defender ATP with Group Policy Objects +## Configure Microsoft Defender ATP with Group Policy Objects The following table lists various tasks you can perform to configure Microsoft Defender ATP with Group Policy Objects. diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index c1a8838634..5e108a70dc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -22,9 +22,9 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -When it comes to managing your organization's threat protection features in Microsoft Defender ATP, we recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection). To learn more, see the following articles: -- [Manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) -- [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md) +We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). Both [Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Desktop Analytics, and other features & capabilities. +- [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) +- [See how you can co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) You can, however, use other tools/methods to perform some tasks. Examples include managing Microsoft Defender Antivirus settings and customizing attack surface reduction rules. These other tools/methods include [PowerShell](#configure-microsoft-defender-atp-with-powershell), [Windows Management Instrumentation](#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi) (WMI), and [The Microsoft Malware Protection Command Line Utility](#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe) (MPCmdRun.exe). From c3afd06326a0ee8f74463741a6641390b570f8e9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 15:51:41 -0700 Subject: [PATCH 099/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 5e108a70dc..bce8c8a4c5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -26,9 +26,9 @@ We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fund - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) - [See how you can co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) -You can, however, use other tools/methods to perform some tasks. Examples include managing Microsoft Defender Antivirus settings and customizing attack surface reduction rules. These other tools/methods include [PowerShell](#configure-microsoft-defender-atp-with-powershell), [Windows Management Instrumentation](#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi) (WMI), and [The Microsoft Malware Protection Command Line Utility](#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe) (MPCmdRun.exe). +You can, however, use other tools/methods, such as [PowerShell](#configure-microsoft-defender-atp-with-powershell), [Windows Management Instrumentation](#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi) (WMI), and the [Microsoft Malware Protection Command Line Utility](#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe) (MPCmdRun.exe), to perform some tasks. For example, you can manage some Microsoft Defender Antivirus settings using these tools. And, in some cases, you can customize your attack surface reduction rules and exploit protection settings. -> [!NOTE] +> [!IMPORTANT] > Threat protection features that you configure by using PowerShell, WMI, or MCPmdRun.exe can be overwritten by configuration settings that are deployed with Intune or Configuration Manager. ## Configure Microsoft Defender ATP with PowerShell @@ -37,26 +37,28 @@ You can use PowerShell to manage Microsoft Defender Antivirus, exploit protectio |Task |Resources to learn more | |---------|---------| -|**Manage Microsoft Defender Antivirus** with PowerShell cmdlets |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus)

[Use PowerShell cmdlets to enable cloud-delivered protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-powershell-cmdlets-to-enable-cloud-delivered-protection) | -|**Configure exploit protection** with PowerShell | [Customize exploit protection: PowerShell reference](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection#powershell-reference) | +|**Manage Microsoft Defender Antivirus**

*View status of antimalware protection, configure preferences for antivirus scans & updates, and make other changes to your antivirus protection.* |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus)

[Use PowerShell cmdlets to enable cloud-delivered protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-powershell-cmdlets-to-enable-cloud-delivered-protection) | +|**Configure exploit protection** to mitigate threats on your organization's devices

*We recommend using exploit protection in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection#powershell) at first. That way, you can see how exploit protection affects apps your organization is using.* | [Customize exploit protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[PowerShell cmdlets for exploit protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection#powershell-reference) | |**Configure attack surface reduction rules** with PowerShell

*You can use PowerShell to exclude files and folders from attack surface reduction rules.* |[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-powershell-to-exclude-files-and-folders) | ## Configure Microsoft Defender ATP with Windows Management Instrumentation (WMI) +WMI is a scripting interface that allows you to retrieve, modify, and update settings. To learn more, see [Using WMI](https://docs.microsoft.com/windows/win32/wmisdk/using-wmi). + |Task |Resources to learn more | |---------|---------| -|**Enable cloud-delivered protection** |[Use Windows Management Instruction (WMI) to enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-windows-management-instruction-wmi-to-enable-cloud-delivered-protection) | -|task 2 | link | +|**Enable cloud-delivered protection** on a device |[Use Windows Management Instruction (WMI) to enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-windows-management-instruction-wmi-to-enable-cloud-delivered-protection) | +|**Retrieve, modify, and update settings** for Microsoft Defender Antivirus | [Use WMI to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus)

[Review the list of available WMI classes and example scripts](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) | ## Configure Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) +On an individual device, you can run a scan, start diagnostic tracing, check for security intellligence updates, and more using the mpcmdrun.exe command line tool. You can find the utility in `%ProgramFiles%\Windows Defender\MpCmdRun.exe`. You must run it from a command prompt. |Task |Resources to learn more | |---------|---------| -|**Manage Microsoft Defender Antivirus** |[Configure and manage Microsoft Defender Antivirus with the Microsoft Malware Protection Command Line Utility (mpcmdrun.exe) command-line tool](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) | -|Row2 | link | +|**Manage Microsoft Defender Antivirus** |[Configure and manage Microsoft Defender Antivirus with mpcmdrun.exe](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) | ## Next steps From f07822db04559b117738c5f9124b4366505e4857 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 15:52:45 -0700 Subject: [PATCH 100/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 3a80ee88a9..0a747c96fc 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -28,7 +28,7 @@ #### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md) ### [Manage Microsoft Defender ATP post migration]() #### [Overview](microsoft-defender-atp/manage-atp-post-migration.md) -#### [Intune](microsoft-defender-atp/manage-atp-post-migration-intune.md) +#### [Intune (recommended)](microsoft-defender-atp/manage-atp-post-migration-intune.md) #### [Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md) #### [Group Policy Objects](microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md) #### [PowerShell, WMI, and MPCmdRun.exe](microsoft-defender-atp/manage-atp-post-migration-other-tools.md) From d0d344780a1a9e2af3f3024b819d51efccb4551a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 16:00:59 -0700 Subject: [PATCH 101/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 6f838c10e4..a75256841a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -29,8 +29,8 @@ The following table lists various tools/methods you can use, with links to learn |Tool/Method |Description | |---------|---------| -|**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | -|**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a complex and powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | +|**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** (recommended) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | +|**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | |**[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy)** |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | -|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configuring Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configuring Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configuring Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | +|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |**We recommend using Intune, Configuration Manager, or Group Policy Objects to manage threat protection features on your organization's devices.** However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe too.

You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configure Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configure Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configure Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | From b73879a46170903896e9a8e124c2f03fc682f073 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 16:01:49 -0700 Subject: [PATCH 102/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index a75256841a..ee067db569 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -32,5 +32,5 @@ The following table lists various tools/methods you can use, with links to learn |**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** (recommended) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | |**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | |**[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy)** |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | -|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |**We recommend using Intune, Configuration Manager, or Group Policy Objects to manage threat protection features on your organization's devices.** However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe too.

You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configure Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configure Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configure Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | +|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |*We recommend using Intune, Configuration Manager, or Group Policy Objects to manage threat protection features on your organization's devices.* However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe too.

You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configure Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configure Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configure Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | From a46996e9470061a723b0cae5d592407d051506e3 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 16:03:17 -0700 Subject: [PATCH 103/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 79850d79fb..0a1f8669e9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -26,7 +26,7 @@ We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fund Both Configuration Manager and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Desktop Analytics, and other features & capabilities. - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) -- [See how you can co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) +- [Co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) ## Configure Microsoft Defender ATP with Configuration Manager From f31da16512a8c4b31d0bd77bc0d1fd90c3b997dd Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 16:05:40 -0700 Subject: [PATCH 104/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index bce8c8a4c5..07119e1daf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -22,11 +22,12 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). Both [Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Desktop Analytics, and other features & capabilities. -- [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) -- [See how you can co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) +> [!NOTE] +> We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). Both [Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Desktop Analytics, and other features & capabilities. +> - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) +> - [Co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) -You can, however, use other tools/methods, such as [PowerShell](#configure-microsoft-defender-atp-with-powershell), [Windows Management Instrumentation](#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi) (WMI), and the [Microsoft Malware Protection Command Line Utility](#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe) (MPCmdRun.exe), to perform some tasks. For example, you can manage some Microsoft Defender Antivirus settings using these tools. And, in some cases, you can customize your attack surface reduction rules and exploit protection settings. +You can manage some Microsoft Defender Antivirus settings on devices with [PowerShell](#configure-microsoft-defender-atp-with-powershell), [Windows Management Instrumentation](#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi) (WMI), and the [Microsoft Malware Protection Command Line Utility](#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe) (MPCmdRun.exe). For example, you can manage some Microsoft Defender Antivirus settings. And, in some cases, you can customize your attack surface reduction rules and exploit protection settings. > [!IMPORTANT] > Threat protection features that you configure by using PowerShell, WMI, or MCPmdRun.exe can be overwritten by configuration settings that are deployed with Intune or Configuration Manager. From a103c543ceeafae8ed0b2dea79c56705aa90f471 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 16:06:55 -0700 Subject: [PATCH 105/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index db8a36ec1c..4abc3360f7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -24,6 +24,7 @@ ms.topic: article We recommend using Microsoft Intune to manage your organization's threat protection features for devices (also referred to as endpoints). Intune is part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Configuration Manager, Desktop Analytics, and other features & capabilities. [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). +This article describes how to find your Microsoft Defender ATP settings in Intune, and lists various tasks you can perform to manage Microsoft Defender ATP for your organization. ## Find your Microsoft Defender ATP settings in Intune From c18d38b833fca33f4d40c7198e32bc86ed3192af Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 16:08:28 -0700 Subject: [PATCH 106/143] Update manage-atp-post-migration-group-policy-objects.md --- .../manage-atp-post-migration-group-policy-objects.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 87fb13aa5b..3a057e1713 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -22,7 +22,10 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use Group Policy Objects in Azure Active Directory Domain Services to manage some settings in Microsoft Defender ATP. +> [!NOTE] +> We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). See [Manage Microsoft Defender Advanced Threat Protection with Intune](manage-atp-post-migration-intune.md). + +You can use Group Policy Objects in Azure Active Directory Domain Services to manage some settings in Microsoft Defender ATP. ## Configure Microsoft Defender ATP with Group Policy Objects From ad6d0572ccb468bcbd16feafbc4db57c6b03ef68 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 16:08:58 -0700 Subject: [PATCH 107/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 0a1f8669e9..290737eb85 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). However, you can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage some settings in Microsoft Defender ATP. +We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). You can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage some settings in Microsoft Defender ATP. Both Configuration Manager and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Desktop Analytics, and other features & capabilities. - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) From a8ea97daede4650b94e102749790afe68395fdf9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 16:10:43 -0700 Subject: [PATCH 108/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 07119e1daf..4ea8ac68a7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -25,7 +25,8 @@ ms.topic: article > [!NOTE] > We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). Both [Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Desktop Analytics, and other features & capabilities. > - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) -> - [Co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) +> - [Co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) +> - [Manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md) You can manage some Microsoft Defender Antivirus settings on devices with [PowerShell](#configure-microsoft-defender-atp-with-powershell), [Windows Management Instrumentation](#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi) (WMI), and the [Microsoft Malware Protection Command Line Utility](#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe) (MPCmdRun.exe). For example, you can manage some Microsoft Defender Antivirus settings. And, in some cases, you can customize your attack surface reduction rules and exploit protection settings. From 163f6d5e322ad273c85256224d8a942fdb30145a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 16:11:25 -0700 Subject: [PATCH 109/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index ee067db569..c6fb94903f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -32,5 +32,5 @@ The following table lists various tools/methods you can use, with links to learn |**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** (recommended) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | |**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | |**[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy)** |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | -|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |*We recommend using Intune, Configuration Manager, or Group Policy Objects to manage threat protection features on your organization's devices.* However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe too.

You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configure Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configure Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configure Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | +|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |*We recommend using Intune, Configuration Manager, or Group Policy Objects to manage threat protection features on your organization's devices. However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe tool.*

You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configure Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configure Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configure Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | From f4fa0d98dcf7cfee9583cfb73e8c6b2fd08f0a6c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 16:12:36 -0700 Subject: [PATCH 110/143] Update manage-atp-post-migration-group-policy-objects.md --- .../manage-atp-post-migration-group-policy-objects.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 3a057e1713..3f9b7d6e6c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -23,7 +23,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) > [!NOTE] -> We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). See [Manage Microsoft Defender Advanced Threat Protection with Intune](manage-atp-post-migration-intune.md). +> We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). See [Manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md). You can use Group Policy Objects in Azure Active Directory Domain Services to manage some settings in Microsoft Defender ATP. From 10e06ef26ba25120a16176dedba0a5c76518520e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 24 Jul 2020 16:13:27 -0700 Subject: [PATCH 111/143] Update manage-atp-post-migration-configuration-manager.md --- .../manage-atp-post-migration-configuration-manager.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 290737eb85..88a0383b79 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -22,9 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). You can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage some settings in Microsoft Defender ATP. - -Both Configuration Manager and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Desktop Analytics, and other features & capabilities. +We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). You can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage some settings in Microsoft Defender ATP. Both Configuration Manager and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Desktop Analytics, and other features & capabilities. - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) - [Co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) From d2840c09d1926bf87841adcca8858b0bdd3302aa Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 08:50:15 -0700 Subject: [PATCH 112/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index c6fb94903f..678b668c71 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -22,13 +22,14 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes Intune and Configuration Manager, to manage your organization's devices and security settings. However, you can use other tools/methods, such as Group Policy Objects. +After you have moved from your previous endpoint protection and antivirus solution to Microsoft Defender ATP, your next step is to manage your features and capabilities. We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), which includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction), to manage your organization's devices and security settings. However, you can use other tools/methods, such as [Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy). The following table lists various tools/methods you can use, with links to learn more.

|Tool/Method |Description | |---------|---------| +|**[Threat and vulnerability management dashboard insights](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights)** in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) |The threat & vulnerability management dashboard provides actionable information that your security operations team can use to reduce exposure and improve your organization's security posture.

See [Threat & vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt). | |**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** (recommended) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | |**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | |**[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy)** |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | From 1bed55dba8bd17397d349de33af460754a6dec65 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 08:52:36 -0700 Subject: [PATCH 113/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 678b668c71..ef1b840b47 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -29,7 +29,7 @@ The following table lists various tools/methods you can use, with links to learn |Tool/Method |Description | |---------|---------| -|**[Threat and vulnerability management dashboard insights](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights)** in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) |The threat & vulnerability management dashboard provides actionable information that your security operations team can use to reduce exposure and improve your organization's security posture.

See [Threat & vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt). | +|**[Threat and vulnerability management dashboard insights](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights)** in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) |The threat & vulnerability management dashboard provides actionable information that your security operations team can use to reduce exposure and improve your organization's security posture.

See [Threat & vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) and [Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use). | |**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** (recommended) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | |**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | |**[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy)** |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | From 9e2c4b5647a915f4e5240c29b219219f895e027a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 08:54:15 -0700 Subject: [PATCH 114/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index ef1b840b47..831eb26632 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -30,8 +30,8 @@ The following table lists various tools/methods you can use, with links to learn |Tool/Method |Description | |---------|---------| |**[Threat and vulnerability management dashboard insights](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights)** in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) |The threat & vulnerability management dashboard provides actionable information that your security operations team can use to reduce exposure and improve your organization's security posture.

See [Threat & vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) and [Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use). | -|**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** (recommended) |Microsoft Intune, a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | -|**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Configuration Manager, formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | +|**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** (recommended) |Microsoft Intune (Intune), a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | +|**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Microsoft Endpoint Configuration Manager (Configuration Manager), formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | |**[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy)** |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | |**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |*We recommend using Intune, Configuration Manager, or Group Policy Objects to manage threat protection features on your organization's devices. However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe tool.*

You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configure Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configure Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configure Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | From 06f50de5e8d4dd3d4ff2268ee3c9be4ec929b496 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 08:58:20 -0700 Subject: [PATCH 115/143] fixes per tech review --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 4abc3360f7..623f638702 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -53,7 +53,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Use Conditional Access** to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | |**Configure Microsoft Defender Antivirus settings** using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus)

[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) | |**If necessary, specify exclusions for Microsoft Defender Antivirus**

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| -|**Configure your attack surface reduction rules** to target software behaviors that are often abused by attackers

*Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) | +|**Configure your attack surface reduction rules** to target software behaviors that are often abused by attackers

*Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)

[Tech Community blog post: Demystifying attack surface reduction rules - Part 1](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/demystifying-attack-surface-reduction-rules-part-1/ba-p/1306420) | |**Configure your network filtering** to block outbound connections from any app to IP addresses or domains with low reputations

*Network filtering is also referred to as [network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection).*

*Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | |**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | |**Configure exploit protection** to protect your organization's devices from malware that uses exploits to spread and infect other devices

*[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection) is also referred to as Exploit Guard.* |[Endpoint protection: Microsoft Defender Exploit Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-exploit-guard)

[Enable exploit protection in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection#intune) | diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 831eb26632..4dc33bb128 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -33,5 +33,5 @@ The following table lists various tools/methods you can use, with links to learn |**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** (recommended) |Microsoft Intune (Intune), a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | |**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Microsoft Endpoint Configuration Manager (Configuration Manager), formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | |**[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy)** |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | -|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |*We recommend using Intune, Configuration Manager, or Group Policy Objects to manage threat protection features on your organization's devices. However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe tool.*

You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configure Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configure Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configure Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | +|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |*We recommend using Microsoft Endpoint Manager (which includes Intune and Configuration Manager) to manage threat protection features on your organization's devices. However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe tool.*

You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configure Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configure Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configure Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | From 69b8fcb5740d5b2e1654f7475b0c64d6fd6191ce Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 09:01:44 -0700 Subject: [PATCH 116/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 623f638702..45ade40e9f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -61,9 +61,18 @@ The following table lists various tasks you can perform to configure Microsoft D |**Configure Microsoft Defender Firewall** to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | |**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | |**Configure Microsoft Defender Credential Guard** to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | -|**Configure your Microsoft Defender Security Center** ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture.

*You can also configure whether and what features end users can see in the Microsoft Defender Security Center.* |[Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use)

[Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center) | |**Configure Microsoft Defender Application Control** to choose whether to audit or trust apps on your organization's devices

*Microsoft Defender Application Control is also referred to as [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).*|[Deploy Microsoft Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune)

[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| +## Configure your Microsoft Defender Security Center + +If you haven't already done so, **configure your Microsoft Defender Security Center** ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture. + +You can also configure whether and what features end users can see in the Microsoft Defender Security Center. + +- [Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) + +- [Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center) + ## Next steps - [Get an overview of threat and vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) From 02fcb153a71864e1340b53d85f764133f56ca3f3 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 09:06:44 -0700 Subject: [PATCH 117/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 45ade40e9f..3d9a877996 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -62,6 +62,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | |**Configure Microsoft Defender Credential Guard** to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | |**Configure Microsoft Defender Application Control** to choose whether to audit or trust apps on your organization's devices

*Microsoft Defender Application Control is also referred to as [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).*|[Deploy Microsoft Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune)

[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| +|**Configure device control and USB peripherals access** to help prevent threats in unauthorized peripherals from compromising your devices |[Control USB devices and other removable media using Microsoft Defender ATP and Intune](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-control/control-usb-devices-using-intune) | ## Configure your Microsoft Defender Security Center From 7c8f31d383801d6a0054e8e69047fbcfd356edd4 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 09:22:09 -0700 Subject: [PATCH 118/143] fixes per tech review --- ...age-atp-post-migration-configuration-manager.md | 14 +++++++++++++- ...nage-atp-post-migration-group-policy-objects.md | 13 ++++++++++++- 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md index 88a0383b79..b61f4e43c1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). You can also use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) to manage some settings in Microsoft Defender ATP. Both Configuration Manager and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Desktop Analytics, and other features & capabilities. +We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) (Intune) to manage your organization's threat protection features for devices (also referred to as endpoints). You can also use [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction) (Configuration Manager) to manage some settings in Microsoft Defender ATP. Both Configuration Manager and Microsoft Intune are part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Desktop Analytics, and other features & capabilities. - [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) - [Co-manage Microsoft Defender ATP on Windows 10 devices with Configuration Manager and Intune](manage-atp-post-migration-intune.md) @@ -34,6 +34,18 @@ We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fund |**Use Configuration Manager to onboard devices** to Microsoft Defender ATP

*If you have devices (or endpoints) not already onboarded to Microsoft Defender ATP, you can do that with Configuration Manager.* |[Onboard to Microsoft Defender ATP with Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection#about-onboarding-to-atp-with-configuration-manager) | |**Manage antimalware policies and Windows Firewall security** for client computers (endpoints)

*Configure endpoint protection features, including Microsoft Defender ATP, exploit protection, application control, antimalware, firewall settings, and more.* |[Configuration Manager: Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection) | |**Choose methods for updating antimalware updates** on your organization's devices

*With Endpoint Protection in Configuration Manager, you can choose from several methods to keep antimalware definitions up to date on your organization's devices.* |[Configure definition updates for Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definition-updates)

[Use Configuration Manager to deliver definition updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-configmgr) | +|**Enable Network Protection** to help prevent employees from using apps that malicious content on the Internet

*We recommend using [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection) at first for network protection in a test environment to see which apps would be blocked before rolling out.* |[Turn on network protection with Configuration Manager](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection#microsoft-endpoint-configuration-manager) | +|**Configure controlled folder access** to protect against ransomware

*Controlled folder access is also referred to as antiransomware protection.* |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Microsoft Endpoint Configuration Manage](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#microsoft-endpoint-configuration-manager) | + +## Configure your Microsoft Defender Security Center + +If you haven't already done so, **configure your Microsoft Defender Security Center** ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture. + +You can also configure whether and what features end users can see in the Microsoft Defender Security Center. + +- [Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) + +- [Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center) ## Next steps diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 3f9b7d6e6c..8ab131365f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -23,7 +23,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) > [!NOTE] -> We recommend using [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) to manage your organization's threat protection features for devices (also referred to as endpoints). See [Manage Microsoft Defender ATP with Intune](manage-atp-post-migration-intune.md). +> We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem) to manage your organization's threat protection features for devices (also referred to as endpoints). Endpoint Manager includes [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction). **[Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview)**. You can use Group Policy Objects in Azure Active Directory Domain Services to manage some settings in Microsoft Defender ATP. @@ -37,6 +37,17 @@ The following table lists various tasks you can perform to configure Microsoft D |**Configure Microsoft Defender Antivirus**

*Configure antivirus features & capabilities, including policy settings, exclusions, remediation, and scheduled scans on your organization's devices (also referred to as endpoints).* |[Use Group Policy settings to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus)

[Use Group Policy to enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-group-policy-to-enable-cloud-delivered-protection) | |**Manage your organization's attack surface reduction rules**

*Customize your attack surface reduction rules by excluding files & folders, or by adding custom text to notification alerts that appear on a users' devices.* |[Customize attack surface reduction rules with Group Policy Objects](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-group-policy-to-exclude-files-and-folders) | |**Manage exploit protection settings**

*You can customize your exploit protection settings, import a configuration file, and then use Group Policy to deploy that configuration file.* |[Customize exploit protection settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[Import, export, and deploy exploit protection configurations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml)

[Use Group Policy to distribute the configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml#use-group-policy-to-distribute-the-configuration) | +|**Enable Network Protection** to help prevent employees from using apps that malicious content on the Internet

*We recommend using [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection) at first for network protection in a test environment to see which apps would be blocked before rolling out.* | | + +## Configure your Microsoft Defender Security Center + +If you haven't already done so, **configure your Microsoft Defender Security Center** ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture. + +You can also configure whether and what features end users can see in the Microsoft Defender Security Center. + +- [Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) + +- [Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center) ## Next steps From f4d4779938f69da99c4e72a3bba07b5a30b9983f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 09:24:04 -0700 Subject: [PATCH 119/143] Update manage-atp-post-migration-group-policy-objects.md --- .../manage-atp-post-migration-group-policy-objects.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 8ab131365f..a21257dae8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -37,7 +37,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Configure Microsoft Defender Antivirus**

*Configure antivirus features & capabilities, including policy settings, exclusions, remediation, and scheduled scans on your organization's devices (also referred to as endpoints).* |[Use Group Policy settings to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus)

[Use Group Policy to enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-group-policy-to-enable-cloud-delivered-protection) | |**Manage your organization's attack surface reduction rules**

*Customize your attack surface reduction rules by excluding files & folders, or by adding custom text to notification alerts that appear on a users' devices.* |[Customize attack surface reduction rules with Group Policy Objects](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-group-policy-to-exclude-files-and-folders) | |**Manage exploit protection settings**

*You can customize your exploit protection settings, import a configuration file, and then use Group Policy to deploy that configuration file.* |[Customize exploit protection settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[Import, export, and deploy exploit protection configurations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml)

[Use Group Policy to distribute the configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml#use-group-policy-to-distribute-the-configuration) | -|**Enable Network Protection** to help prevent employees from using apps that malicious content on the Internet

*We recommend using [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection) at first for network protection in a test environment to see which apps would be blocked before rolling out.* | | +|**Enable Network Protection** to help prevent employees from using apps that malicious content on the Internet

*We recommend using [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection) at first for network protection in a test environment to see which apps would be blocked before rolling out.* |[Turn on network protection using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection#group-policy) | ## Configure your Microsoft Defender Security Center From 526831ee2e3f81a3dab5a1062f5881cb2a75ff99 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 09:27:54 -0700 Subject: [PATCH 120/143] Update manage-atp-post-migration-group-policy-objects.md --- .../manage-atp-post-migration-group-policy-objects.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index a21257dae8..60966bfab9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -38,6 +38,8 @@ The following table lists various tasks you can perform to configure Microsoft D |**Manage your organization's attack surface reduction rules**

*Customize your attack surface reduction rules by excluding files & folders, or by adding custom text to notification alerts that appear on a users' devices.* |[Customize attack surface reduction rules with Group Policy Objects](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-group-policy-to-exclude-files-and-folders) | |**Manage exploit protection settings**

*You can customize your exploit protection settings, import a configuration file, and then use Group Policy to deploy that configuration file.* |[Customize exploit protection settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[Import, export, and deploy exploit protection configurations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml)

[Use Group Policy to distribute the configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml#use-group-policy-to-distribute-the-configuration) | |**Enable Network Protection** to help prevent employees from using apps that malicious content on the Internet

*We recommend using [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection) at first for network protection in a test environment to see which apps would be blocked before rolling out.* |[Turn on network protection using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection#group-policy) | +|**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Enable controlled folder access using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#group-policy) | +|**Configure Microsoft Defender SmartScreen** to protect against malicious sites and files on the internet. |[Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings: Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#group-policy-settings) | ## Configure your Microsoft Defender Security Center From 2627595e5d594e6c6c181e2e86106f55c3032057 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 09:42:10 -0700 Subject: [PATCH 121/143] Update manage-atp-post-migration-group-policy-objects.md --- .../manage-atp-post-migration-group-policy-objects.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 60966bfab9..8be3abc883 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -39,7 +39,8 @@ The following table lists various tasks you can perform to configure Microsoft D |**Manage exploit protection settings**

*You can customize your exploit protection settings, import a configuration file, and then use Group Policy to deploy that configuration file.* |[Customize exploit protection settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[Import, export, and deploy exploit protection configurations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml)

[Use Group Policy to distribute the configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml#use-group-policy-to-distribute-the-configuration) | |**Enable Network Protection** to help prevent employees from using apps that malicious content on the Internet

*We recommend using [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection) at first for network protection in a test environment to see which apps would be blocked before rolling out.* |[Turn on network protection using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection#group-policy) | |**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Enable controlled folder access using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#group-policy) | -|**Configure Microsoft Defender SmartScreen** to protect against malicious sites and files on the internet. |[Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings: Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#group-policy-settings) | +|**Configure Microsoft Defender SmartScreen** to protect against malicious sites and files on the internet. |[Configure Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#group-policy-settings) | + ## Configure your Microsoft Defender Security Center From 967cd12276203cd53002d836fb3a80c2112878d5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 09:49:07 -0700 Subject: [PATCH 122/143] Update manage-atp-post-migration-group-policy-objects.md --- .../manage-atp-post-migration-group-policy-objects.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 8be3abc883..e1feabfbe4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -40,7 +40,8 @@ The following table lists various tasks you can perform to configure Microsoft D |**Enable Network Protection** to help prevent employees from using apps that malicious content on the Internet

*We recommend using [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection) at first for network protection in a test environment to see which apps would be blocked before rolling out.* |[Turn on network protection using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection#group-policy) | |**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Enable controlled folder access using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#group-policy) | |**Configure Microsoft Defender SmartScreen** to protect against malicious sites and files on the internet. |[Configure Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#group-policy-settings) | - +|**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[BitLocker Group Policy settings](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings) | +|**Configure Microsoft Defender Credential Guard** to protect against credential theft attacks |[Enable Windows Defender Credential Guard by using Group Policy](https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage#enable-windows-defender-credential-guard-by-using-group-policy) | ## Configure your Microsoft Defender Security Center From 3e077b61a4acc2ea49e539641458791917a48c41 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 09:58:29 -0700 Subject: [PATCH 123/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 4ea8ac68a7..390a13b85f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -41,7 +41,13 @@ You can use PowerShell to manage Microsoft Defender Antivirus, exploit protectio |---------|---------| |**Manage Microsoft Defender Antivirus**

*View status of antimalware protection, configure preferences for antivirus scans & updates, and make other changes to your antivirus protection.* |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus)

[Use PowerShell cmdlets to enable cloud-delivered protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-powershell-cmdlets-to-enable-cloud-delivered-protection) | |**Configure exploit protection** to mitigate threats on your organization's devices

*We recommend using exploit protection in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection#powershell) at first. That way, you can see how exploit protection affects apps your organization is using.* | [Customize exploit protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[PowerShell cmdlets for exploit protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection#powershell-reference) | -|**Configure attack surface reduction rules** with PowerShell

*You can use PowerShell to exclude files and folders from attack surface reduction rules.* |[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-powershell-to-exclude-files-and-folders) | +|**Configure attack surface reduction rules** with PowerShell

*You can use PowerShell to exclude files and folders from attack surface reduction rules.* |[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-powershell-to-exclude-files-and-folders)

Also, see [António Vasconcelo's graphical user interface tool for setting attack surface reduction rules with PowerShell](https://github.com/anvascon/MDATP_PoSh_Scripts/tree/master/ASR%20GUI). | +|**Enable Network Protection** with PowerShell

*You can use PowerShell to enable Network Protection.* |[Turn on Network Protection with PowerShell](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection#powershell) | +|**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Enable controlled folder access with PowerShell](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#powershell) | +|**Configure Microsoft Defender Firewall** to block unauthorized network traffic flowing into or out of your organization's devices |[](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell) | +|**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[](https://docs.microsoft.com/powershell/module/bitlocker/?view=win10-ps) | + + ## Configure Microsoft Defender ATP with Windows Management Instrumentation (WMI) @@ -62,6 +68,16 @@ On an individual device, you can run a scan, start diagnostic tracing, check for |---------|---------| |**Manage Microsoft Defender Antivirus** |[Configure and manage Microsoft Defender Antivirus with mpcmdrun.exe](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) | +## Configure your Microsoft Defender Security Center + +If you haven't already done so, **configure your Microsoft Defender Security Center** ([https://securitycenter.windows.com](https://securitycenter.windows.com)) to view alerts, configure threat protection features, and view detailed information about your organization's overall security posture. + +You can also configure whether and what features end users can see in the Microsoft Defender Security Center. + +- [Overview of the Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) + +- [Endpoint protection: Microsoft Defender Security Center](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-security-center) + ## Next steps From 1457d67542c2de98d37757cb83fc19322202f384 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 10:06:09 -0700 Subject: [PATCH 124/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 390a13b85f..c920b94b37 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -44,11 +44,8 @@ You can use PowerShell to manage Microsoft Defender Antivirus, exploit protectio |**Configure attack surface reduction rules** with PowerShell

*You can use PowerShell to exclude files and folders from attack surface reduction rules.* |[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-powershell-to-exclude-files-and-folders)

Also, see [António Vasconcelo's graphical user interface tool for setting attack surface reduction rules with PowerShell](https://github.com/anvascon/MDATP_PoSh_Scripts/tree/master/ASR%20GUI). | |**Enable Network Protection** with PowerShell

*You can use PowerShell to enable Network Protection.* |[Turn on Network Protection with PowerShell](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection#powershell) | |**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Enable controlled folder access with PowerShell](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#powershell) | -|**Configure Microsoft Defender Firewall** to block unauthorized network traffic flowing into or out of your organization's devices |[](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell) | -|**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[](https://docs.microsoft.com/powershell/module/bitlocker/?view=win10-ps) | - - - +|**Configure Microsoft Defender Firewall** to block unauthorized network traffic flowing into or out of your organization's devices |[Microsoft Defender Firewall with Advanced Security Administration using Windows PowerShell](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell) | +|**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[BitLocker PowerShell reference guide](https://docs.microsoft.com/powershell/module/bitlocker/?view=win10-ps) | ## Configure Microsoft Defender ATP with Windows Management Instrumentation (WMI) @@ -57,7 +54,7 @@ WMI is a scripting interface that allows you to retrieve, modify, and update set |Task |Resources to learn more | |---------|---------| |**Enable cloud-delivered protection** on a device |[Use Windows Management Instruction (WMI) to enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-windows-management-instruction-wmi-to-enable-cloud-delivered-protection) | -|**Retrieve, modify, and update settings** for Microsoft Defender Antivirus | [Use WMI to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus)

[Review the list of available WMI classes and example scripts](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) | +|**Retrieve, modify, and update settings** for Microsoft Defender Antivirus | [Use WMI to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus)

[Review the list of available WMI classes and example scripts](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal)

Also see the archived [Windows Defender WMIv2 Provider reference information](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal?redirectedfrom=MSDN) | ## Configure Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) From 4434672bae495ddd6e6fa76e65acec7e3550fd2e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 10:08:50 -0700 Subject: [PATCH 125/143] Update symantec-to-microsoft-defender-atp-onboard.md --- .../symantec-to-microsoft-defender-atp-onboard.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md b/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md index 974c635e5d..6c7c329a2e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md @@ -97,5 +97,4 @@ To do this, visit the Microsoft Defender ATP demo scenarios site ([https://demo. **Congratulations**! You have completed your [migration from Symantec to Microsoft Defender ATP](symantec-to-microsoft-defender-atp-migration.md#the-migration-process)! - [Visit your security operations dashboard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard) in the Microsoft Defender Security Center ([https://aka.ms/MDATPportal](https://aka.ms/MDATPportal)). - -- To learn more about Microsoft Defender ATP and how to configure or adjust various features and capabilities, see [Microsoft Defender ATP documentation](https://docs.microsoft.com/windows/security/threat-protection). +- [Manage Microsoft Defender Advanced Threat Protection, post migration](manage-atp-post-migration.md). From c446c8346396c7004c422c1361e635d0368dd0e2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 10:12:41 -0700 Subject: [PATCH 126/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 5383032564..ee3730fb83 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -326,7 +326,6 @@ ###### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center) ###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file) ###### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis) -###### [Submit files for analysis](microsoft-defender-atp/respond-file-alerts.md#submit-files-for-analysis) ###### [View deep analysis reports](microsoft-defender-atp/respond-file-alerts.md#view-deep-analysis-reports) ###### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis) From 7c3775ee52ebd730e6613b455ed040faeda8f09e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 10:13:45 -0700 Subject: [PATCH 127/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index ee3730fb83..fa86eb0bc1 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -325,7 +325,7 @@ ###### [Consult a threat expert](microsoft-defender-atp/respond-file-alerts.md#consult-a-threat-expert) ###### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center) ###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file) -###### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis) +###### [[Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis)](#deep-analysismicrosoft-defender-atprespond-file-alertsmddeep-analysis) ###### [View deep analysis reports](microsoft-defender-atp/respond-file-alerts.md#view-deep-analysis-reports) ###### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis) From c5cfc089326fc13b905249e5ce65bea6421c81ad Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 10:15:50 -0700 Subject: [PATCH 128/143] fixing build error reports --- .../manage-atp-post-migration-group-policy-objects.md | 2 +- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- .../manage-atp-post-migration-other-tools.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index e1feabfbe4..9cee59b503 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -40,7 +40,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Enable Network Protection** to help prevent employees from using apps that malicious content on the Internet

*We recommend using [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection) at first for network protection in a test environment to see which apps would be blocked before rolling out.* |[Turn on network protection using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection#group-policy) | |**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Enable controlled folder access using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#group-policy) | |**Configure Microsoft Defender SmartScreen** to protect against malicious sites and files on the internet. |[Configure Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#group-policy-settings) | -|**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[BitLocker Group Policy settings](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings) | +|**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[BitLocker Group Policy settings](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings) | |**Configure Microsoft Defender Credential Guard** to protect against credential theft attacks |[Enable Windows Defender Credential Guard by using Group Policy](https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage#enable-windows-defender-credential-guard-by-using-group-policy) | ## Configure your Microsoft Defender Security Center diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 3d9a877996..32b597f11b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -62,7 +62,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | |**Configure Microsoft Defender Credential Guard** to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | |**Configure Microsoft Defender Application Control** to choose whether to audit or trust apps on your organization's devices

*Microsoft Defender Application Control is also referred to as [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).*|[Deploy Microsoft Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune)

[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| -|**Configure device control and USB peripherals access** to help prevent threats in unauthorized peripherals from compromising your devices |[Control USB devices and other removable media using Microsoft Defender ATP and Intune](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-control/control-usb-devices-using-intune) | +|**Configure device control and USB peripherals access** to help prevent threats in unauthorized peripherals from compromising your devices |[Control USB devices and other removable media using Microsoft Defender ATP and Intune](https://docs.microsoft.com/windows/security/threat-protection/device-control/control-usb-devices-using-intune) | ## Configure your Microsoft Defender Security Center diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index c920b94b37..277cc9bfb9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -39,7 +39,7 @@ You can use PowerShell to manage Microsoft Defender Antivirus, exploit protectio |Task |Resources to learn more | |---------|---------| -|**Manage Microsoft Defender Antivirus**

*View status of antimalware protection, configure preferences for antivirus scans & updates, and make other changes to your antivirus protection.* |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus)

[Use PowerShell cmdlets to enable cloud-delivered protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-powershell-cmdlets-to-enable-cloud-delivered-protection) | +|**Manage Microsoft Defender Antivirus**

*View status of antimalware protection, configure preferences for antivirus scans & updates, and make other changes to your antivirus protection.* |[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus)

[Use PowerShell cmdlets to enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-powershell-cmdlets-to-enable-cloud-delivered-protection) | |**Configure exploit protection** to mitigate threats on your organization's devices

*We recommend using exploit protection in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection#powershell) at first. That way, you can see how exploit protection affects apps your organization is using.* | [Customize exploit protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[PowerShell cmdlets for exploit protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection#powershell-reference) | |**Configure attack surface reduction rules** with PowerShell

*You can use PowerShell to exclude files and folders from attack surface reduction rules.* |[Customize attack surface reduction rules: Use PowerShell to exclude files & folders](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-powershell-to-exclude-files-and-folders)

Also, see [António Vasconcelo's graphical user interface tool for setting attack surface reduction rules with PowerShell](https://github.com/anvascon/MDATP_PoSh_Scripts/tree/master/ASR%20GUI). | |**Enable Network Protection** with PowerShell

*You can use PowerShell to enable Network Protection.* |[Turn on Network Protection with PowerShell](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection#powershell) | From 1444461279695a180b17d5ef92b11003d4c0db0b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 10:22:21 -0700 Subject: [PATCH 129/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index fa86eb0bc1..ee3730fb83 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -325,7 +325,7 @@ ###### [Consult a threat expert](microsoft-defender-atp/respond-file-alerts.md#consult-a-threat-expert) ###### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center) ###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file) -###### [[Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis)](#deep-analysismicrosoft-defender-atprespond-file-alertsmddeep-analysis) +###### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis) ###### [View deep analysis reports](microsoft-defender-atp/respond-file-alerts.md#view-deep-analysis-reports) ###### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis) From 0c12a92e71502aac020cf834fccada9cd09f7004 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 10:25:51 -0700 Subject: [PATCH 130/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index ee3730fb83..0ab3a24248 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -326,8 +326,6 @@ ###### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center) ###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file) ###### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis) -###### [View deep analysis reports](microsoft-defender-atp/respond-file-alerts.md#view-deep-analysis-reports) -###### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis) #### [View and approve remediation actions](microsoft-defender-atp/manage-auto-investigation.md) ##### [View details and results of automated investigations](microsoft-defender-atp/auto-investigation-action-center.md) From 213d57311ec8c54984148920fc41a8d0e8031e46 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:04:26 -0700 Subject: [PATCH 131/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 0ab3a24248..c9f8c972e8 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -115,7 +115,7 @@ #### [Configure next-generation protection]() ##### [Configure Microsoft Defender Antivirus features](microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md) -##### [Utilize Microsoft cloud-delivered protection](microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) +##### [Use Microsoft cloud-delivered protection](microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) ###### [Enable cloud-delivered protection](microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) ###### [Specify the cloud-delivered protection level](microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md) ###### [Configure and validate network connections](microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md) From 47b3051fd219a3ab93c1f869fcfcf66a4441e08e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:05:06 -0700 Subject: [PATCH 132/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index c9f8c972e8..2ec2e30055 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -199,7 +199,7 @@ ##### [Manage next-generation protection in your business]() ###### [Handle false positives/negatives in Microsoft Defender Antivirus](microsoft-defender-antivirus/antivirus-false-positives-negatives.md) ###### [Management overview](microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md) -###### [Use Microsoft Intune and Microsoft Endpoint Configuration Manager to manage next generation protection](microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md) +###### [Use Microsoft Intune and Microsoft Endpoint Configuration Manager to manage next-generation protection](microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md) ###### [Use Group Policy settings to manage next generation protection](microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md) ###### [Use PowerShell cmdlets to manage next generation protection](microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md) ###### [Use Windows Management Instrumentation (WMI) to manage next generation protection](microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md) From 8afb6caa444c8683584e7b959f37edd06c256e53 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:06:33 -0700 Subject: [PATCH 133/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 2ec2e30055..755a490fbd 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -200,10 +200,10 @@ ###### [Handle false positives/negatives in Microsoft Defender Antivirus](microsoft-defender-antivirus/antivirus-false-positives-negatives.md) ###### [Management overview](microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md) ###### [Use Microsoft Intune and Microsoft Endpoint Configuration Manager to manage next-generation protection](microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md) -###### [Use Group Policy settings to manage next generation protection](microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md) -###### [Use PowerShell cmdlets to manage next generation protection](microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md) -###### [Use Windows Management Instrumentation (WMI) to manage next generation protection](microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md) -###### [Use the mpcmdrun.exe command line tool to manage next generation protection](microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md) +###### [Use Group Policy settings to manage next-generation protection](microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md) +###### [Use PowerShell cmdlets to manage next-generation protection](microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md) +###### [Use Windows Management Instrumentation (WMI) to manage next-generation protection](microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md) +###### [Use the mpcmdrun.exe command line tool to manage next-generation protection](microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md) #### [Better together: Microsoft Defender Antivirus and Microsoft Defender ATP](microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md) @@ -308,8 +308,8 @@ ##### [Take response actions on a device]() ###### [Response actions on devices](microsoft-defender-atp/respond-machine-alerts.md) ###### [Manage tags](microsoft-defender-atp/respond-machine-alerts.md#manage-tags) -###### [Initiate an automated investigation](microsoft-defender-atp/respond-machine-alerts.md#initiate-automated-investigation) -###### [Initiate Live Response session](microsoft-defender-atp/respond-machine-alerts.md#initiate-live-response-session) +###### [Start an automated investigation](microsoft-defender-atp/respond-machine-alerts.md#initiate-automated-investigation) +###### [Start a Live Response session](microsoft-defender-atp/respond-machine-alerts.md#initiate-live-response-session) ###### [Collect investigation package](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-devices) ###### [Run antivirus scan](microsoft-defender-atp/respond-machine-alerts.md#run-microsoft-defender-antivirus-scan-on-devices) ###### [Restrict app execution](microsoft-defender-atp/respond-machine-alerts.md#restrict-app-execution) From 2728b7d4e52122bad4450f528e4a2c29b9436e4e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:08:29 -0700 Subject: [PATCH 134/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 755a490fbd..245796abc4 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -425,7 +425,7 @@ #### [Ensure your devices are configured properly](microsoft-defender-atp/configure-machines.md) #### [Monitor and increase device onboarding](microsoft-defender-atp/configure-machines-onboarding.md) #### [Increase compliance to the security baseline](microsoft-defender-atp/configure-machines-security-baseline.md) -#### [Optimize ASR rule deployment and detections](microsoft-defender-atp/configure-machines-asr.md) +#### [Optimize attack surface reduction rule deployment and detections](microsoft-defender-atp/configure-machines-asr.md) ### [Configure portal settings]() #### [Set up preferences](microsoft-defender-atp/preferences-setup.md) @@ -1218,7 +1218,7 @@ ###### [System cryptography: Force strong key protection for user keys stored on the computer](security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md) ###### [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md) ###### [System objects: Require case insensitivity for non-Windows subsystems](security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md) -###### [System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)](security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md) +###### [System objects: Strengthen default permissions of internal system objects (Symbolic Links)](security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md) ###### [System settings: Optional subsystems](security-policy-settings/system-settings-optional-subsystems.md) ###### [System settings: Use certificate rules on Windows executables for Software Restriction Policies](security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md) ###### [User Account Control: Admin Approval Mode for the Built-in Administrator account](security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md) From b013cff1cdb7ca7e6db6c4fde17d870ceb6383ba Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:09:37 -0700 Subject: [PATCH 135/143] Update TOC.md --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 245796abc4..0d071ba0be 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -825,7 +825,7 @@ ####### [Event 4765 S: SID History was added to an account.](auditing/event-4765.md) ####### [Event 4766 F: An attempt to add SID History to an account failed.](auditing/event-4766.md) ####### [Event 4767 S: A user account was unlocked.](auditing/event-4767.md) -####### [Event 4780 S: The ACL was set on accounts which are members of administrators groups.](auditing/event-4780.md) +####### [Event 4780 S: The ACL was set on accounts that are members of administrators groups.](auditing/event-4780.md) ####### [Event 4781 S: The name of an account was changed.](auditing/event-4781.md) ####### [Event 4794 S, F: An attempt was made to set the Directory Services Restore Mode administrator password.](auditing/event-4794.md) ####### [Event 4798 S: A user's local group membership was enumerated.](auditing/event-4798.md) From 83dedc9dab3fc026f90c4e539365da19ed803ece Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:11:04 -0700 Subject: [PATCH 136/143] Update manage-atp-post-migration.md --- .../microsoft-defender-atp/manage-atp-post-migration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md index 4dc33bb128..f716c99579 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md @@ -33,5 +33,5 @@ The following table lists various tools/methods you can use, with links to learn |**[Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune)** (recommended) |Microsoft Intune (Intune), a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview), focuses on mobile device management (MDM) and mobile application management (MAM). With Intune, you control how your organization’s devices are used, including mobile phones, tablets, and laptops. You can also configure specific policies to control applications.

See [Manage Microsoft Defender ATP using Intune](manage-atp-post-migration-intune.md). | |**[Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/understand/introduction)** |Microsoft Endpoint Configuration Manager (Configuration Manager), formerly known as System Center Configuration Manager, is a component of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). Configuration Manager is a powerful tool to manage your users, devices, and software.

See [Manage Microsoft Defender ATP with Configuration Manager](manage-atp-post-migration-configuration-manager.md). | |**[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy)** |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs).

See [Manage Microsoft Defender ATP with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). | -|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |*We recommend using Microsoft Endpoint Manager (which includes Intune and Configuration Manager) to manage threat protection features on your organization's devices. However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe tool.*

You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configure Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configure Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configure Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | +|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |*We recommend using Microsoft Endpoint Manager (which includes Intune and Configuration Manager) to manage threat protection features on your organization's devices. However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe tool.*

You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configure Microsoft Defender ATP with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-powershell).

You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configure Microsoft Defender ATP with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-windows-management-instrumentation-wmi).

You can use the Microsoft Malware Protection Command-Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configure Microsoft Defender ATP with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-atp-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). | From 1216e7fd8d977eab1d2cd0e773152a0cad5f0d5f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:11:56 -0700 Subject: [PATCH 137/143] Update manage-atp-post-migration-group-policy-objects.md --- .../manage-atp-post-migration-group-policy-objects.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 9cee59b503..1c62f92013 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -1,6 +1,6 @@ --- title: Manage Microsoft Defender ATP using Group Policy Objects -description: Learn how to manage Microsoft Defender ATP with PowerShell +description: Learn how to manage Microsoft Defender ATP with Group Policy Objects keywords: post-migration, manage, operations, maintenance, utilization, PowerShell, windows defender advanced threat protection, atp, edr search.product: eADQiWindows 10XVcnh search.appverid: met150 From 3d3a0949e1c713f870f4910c813bccfb3c5260ec Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:12:28 -0700 Subject: [PATCH 138/143] Update manage-atp-post-migration-group-policy-objects.md --- .../manage-atp-post-migration-group-policy-objects.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md index 1c62f92013..1e7317f3e8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md @@ -35,7 +35,7 @@ The following table lists various tasks you can perform to configure Microsoft D |---------|---------| |**Manage settings for user and computer objects**

*Customize built-in Group Policy Objects, or create custom Group Policy Objects and organizational units to suit your organizational needs.* |[Administer Group Policy in an Azure Active Directory Domain Services managed domain](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) | |**Configure Microsoft Defender Antivirus**

*Configure antivirus features & capabilities, including policy settings, exclusions, remediation, and scheduled scans on your organization's devices (also referred to as endpoints).* |[Use Group Policy settings to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus)

[Use Group Policy to enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus#use-group-policy-to-enable-cloud-delivered-protection) | -|**Manage your organization's attack surface reduction rules**

*Customize your attack surface reduction rules by excluding files & folders, or by adding custom text to notification alerts that appear on a users' devices.* |[Customize attack surface reduction rules with Group Policy Objects](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-group-policy-to-exclude-files-and-folders) | +|**Manage your organization's attack surface reduction rules**

*Customize your attack surface reduction rules by excluding files & folders, or by adding custom text to notification alerts that appear on users' devices.* |[Customize attack surface reduction rules with Group Policy Objects](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction#use-group-policy-to-exclude-files-and-folders) | |**Manage exploit protection settings**

*You can customize your exploit protection settings, import a configuration file, and then use Group Policy to deploy that configuration file.* |[Customize exploit protection settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection)

[Import, export, and deploy exploit protection configurations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml)

[Use Group Policy to distribute the configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml#use-group-policy-to-distribute-the-configuration) | |**Enable Network Protection** to help prevent employees from using apps that malicious content on the Internet

*We recommend using [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection) at first for network protection in a test environment to see which apps would be blocked before rolling out.* |[Turn on network protection using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection#group-policy) | |**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Enable controlled folder access using Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#group-policy) | From 27c1640d051e7a0fafb808f4a2c8eb8950db13dc Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:13:18 -0700 Subject: [PATCH 139/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 32b597f11b..f73c304475 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -44,7 +44,7 @@ This article describes how to find your Microsoft Defender ATP settings in Intun ## Configure Microsoft Defender ATP with Intune -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. You don't have to configure everything all at once; choose a task, read the corresponding resources, and then proceed from there, at your pace. +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. You don't have to configure everything all at once; choose a task, read the corresponding resources, and then proceed from there. |Task |Resources to learn more | |---------|---------| From d5ed2bc71c9cc5d9b2ab2dd1f6237fdc27d29667 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:13:49 -0700 Subject: [PATCH 140/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index f73c304475..2dfb129024 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -44,7 +44,7 @@ This article describes how to find your Microsoft Defender ATP settings in Intun ## Configure Microsoft Defender ATP with Intune -The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. You don't have to configure everything all at once; choose a task, read the corresponding resources, and then proceed from there. +The following table lists various tasks you can perform to configure Microsoft Defender ATP with Intune. You don't have to configure everything all at once; choose a task, read the corresponding resources, and then proceed. |Task |Resources to learn more | |---------|---------| @@ -61,7 +61,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Configure Microsoft Defender Firewall** to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | |**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | |**Configure Microsoft Defender Credential Guard** to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | -|**Configure Microsoft Defender Application Control** to choose whether to audit or trust apps on your organization's devices

*Microsoft Defender Application Control is also referred to as [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).*|[Deploy Microsoft Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune)

[Endpoint protection: MIcrosoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| +|**Configure Microsoft Defender Application Control** to choose whether to audit or trust apps on your organization's devices

*Microsoft Defender Application Control is also referred to as [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).*|[Deploy Microsoft Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune)

[Endpoint protection: Microsoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| |**Configure device control and USB peripherals access** to help prevent threats in unauthorized peripherals from compromising your devices |[Control USB devices and other removable media using Microsoft Defender ATP and Intune](https://docs.microsoft.com/windows/security/threat-protection/device-control/control-usb-devices-using-intune) | ## Configure your Microsoft Defender Security Center From fecb9904061662a1e4e4499553db725393191f92 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:15:11 -0700 Subject: [PATCH 141/143] Update manage-atp-post-migration-intune.md --- .../manage-atp-post-migration-intune.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 2dfb129024..1692f971c7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -52,7 +52,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Integrate Microsoft Defender ATP with Intune** as a Mobile Threat Defense solution
*(for Android devices and devices running Windows 10 or later)* |[Enforce compliance for Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection) | |**Use Conditional Access** to control the devices and apps that can connect to your email and company resources |[Configure Conditional Access in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access) | |**Configure Microsoft Defender Antivirus settings** using the Policy configuration service provider ([Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider)) |[Device restrictions: Microsoft Defender Antivirus](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus)

[Policy CSP - Microsoft Defender ATP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) | -|**If necessary, specify exclusions for Microsoft Defender Antivirus**

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known OS behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| +|**If necessary, specify exclusions for Microsoft Defender Antivirus**

*Generally, you shouldn't need to apply exclusions. Microsoft Defender Antivirus includes a number of automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios.* |[Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows](https://support.microsoft.com/help/822158/virus-scanning-recommendations-for-enterprise-computers)

[Device restrictions: Microsoft Defender Antivirus Exclusions for Windows 10 devices](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-antivirus-exclusions)

[Configure Microsoft Defender Antivirus exclusions on Windows Server 2016 or 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus)| |**Configure your attack surface reduction rules** to target software behaviors that are often abused by attackers

*Configure your attack surface reduction rules in [audit mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender) at first (for at least one week and up to two months). You can monitor status using Power BI ([get our template](https://github.com/microsoft/MDATP-PowerBI-Templates/tree/master/Attack%20Surface%20Reduction%20rules)), and then set those rules to active mode when you're ready.* |[Audit mode in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender)

[Endpoint protection: Attack Surface Reduction](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10?toc=/intune/configuration/toc.json&bc=/intune/configuration/breadcrumb/toc.json#attack-surface-reduction)

[Learn more about attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)

[Tech Community blog post: Demystifying attack surface reduction rules - Part 1](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/demystifying-attack-surface-reduction-rules-part-1/ba-p/1306420) | |**Configure your network filtering** to block outbound connections from any app to IP addresses or domains with low reputations

*Network filtering is also referred to as [network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection).*

*Make sure that Windows 10 devices have the latest [antimalware platform updates](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform) installed.*|[Endpoint protection: Network filtering](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering)

[Review network protection events in Windows Event Viewer](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection#review-network-protection-events-in-windows-event-viewer) | |**Configure controlled folder access** to protect against ransomware

*[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders) is also referred to as antiransomware protection.* |[Endpoint protection: Controlled folder access](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#controlled-folder-access)

[Enable controlled folder access in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders#intune) | @@ -60,7 +60,7 @@ The following table lists various tasks you can perform to configure Microsoft D |**Configure Microsoft Defender SmartScreen** to protect against malicious sites and files on the internet.

*Microsoft Edge should be installed on your organization's devices. For protection on Google Chrome and FireFox browsers, configure exploit protection.* |[Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)

[Device restrictions: Microsoft Defender SmartScreen](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10#microsoft-defender-smartscreen)

[Policy settings for managing SmartScreen in Intune](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings#mdm-settings) | |**Configure Microsoft Defender Firewall** to block unauthorized network traffic flowing into or out of your organization's devices |[Endpoint protection: Microsoft Defender Firewall](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-firewall)

[Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security) | |**Configure encryption and BitLocker** to protect information on your organization's devices running Windows |[Endpoint protection: Windows Encryption](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#windows-encryption)

[BitLocker for Windows 10 devices](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) | -|**Configure Microsoft Defender Credential Guard** to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | +|**Configure Microsoft Defender Credential Guard** to protect against credential theft attacks |For Windows 10, Windows Server 2016, and Windows Server 2019, see [Endpoint protection: Microsoft Defender Credential Guard](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-credential-guard)

For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, and Windows Server 2012 R2, see [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Versions 1 and 2](https://www.microsoft.com/download/details.aspx?id=36036) | |**Configure Microsoft Defender Application Control** to choose whether to audit or trust apps on your organization's devices

*Microsoft Defender Application Control is also referred to as [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).*|[Deploy Microsoft Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune)

[Endpoint protection: Microsoft Defender Application Control](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control)

[AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp)| |**Configure device control and USB peripherals access** to help prevent threats in unauthorized peripherals from compromising your devices |[Control USB devices and other removable media using Microsoft Defender ATP and Intune](https://docs.microsoft.com/windows/security/threat-protection/device-control/control-usb-devices-using-intune) | From 702c6aefd8974d59a14208c4aff7b1aaf9b52c83 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:17:13 -0700 Subject: [PATCH 142/143] Update manage-atp-post-migration-other-tools.md --- .../manage-atp-post-migration-other-tools.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md index 277cc9bfb9..88f4e96298 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md @@ -57,9 +57,9 @@ WMI is a scripting interface that allows you to retrieve, modify, and update set |**Retrieve, modify, and update settings** for Microsoft Defender Antivirus | [Use WMI to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus)

[Review the list of available WMI classes and example scripts](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal)

Also see the archived [Windows Defender WMIv2 Provider reference information](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal?redirectedfrom=MSDN) | -## Configure Microsoft Defender ATP with Microsoft Malware Protection Command Line Utility (MPCmdRun.exe) +## Configure Microsoft Defender ATP with Microsoft Malware Protection Command-Line Utility (MPCmdRun.exe) -On an individual device, you can run a scan, start diagnostic tracing, check for security intellligence updates, and more using the mpcmdrun.exe command line tool. You can find the utility in `%ProgramFiles%\Windows Defender\MpCmdRun.exe`. You must run it from a command prompt. +On an individual device, you can run a scan, start diagnostic tracing, check for security intelligence updates, and more using the mpcmdrun.exe command-line tool. You can find the utility in `%ProgramFiles%\Windows Defender\MpCmdRun.exe`. Run it from a command prompt. |Task |Resources to learn more | |---------|---------| From 23713063f3886026e5a84dad23c37f3d3bdd2228 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 31 Jul 2020 11:21:25 -0700 Subject: [PATCH 143/143] Update manage-atp-post-migration-intune.md --- .../microsoft-defender-atp/manage-atp-post-migration-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md index 1692f971c7..cdd0080bd4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md @@ -24,7 +24,7 @@ ms.topic: article We recommend using Microsoft Intune to manage your organization's threat protection features for devices (also referred to as endpoints). Intune is part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem), along with Configuration Manager, Desktop Analytics, and other features & capabilities. [Learn more about Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). -This article describes how to find your Microsoft Defender ATP settings in Intune, and lists various tasks you can perform to manage Microsoft Defender ATP for your organization. +This article describes how to find your Microsoft Defender ATP settings in Intune, and lists various tasks you can perform. ## Find your Microsoft Defender ATP settings in Intune