diff --git a/bcs/index.md b/bcs/index.md index 50a9709c7e..01f7f2e27b 100644 --- a/bcs/index.md +++ b/bcs/index.md @@ -13,7 +13,7 @@ description: Learn about the product documentation and resources available for M
+ +[AppLocker CSP](applocker-csp.md) +

Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in [Whitelist examples](applocker-csp.md#whitelist-examples).

+ + +[DeviceManageability CSP](devicemanageability-csp.md) +

Added the following settings in Windows 10, version 1709:

+ + [Policy CSP](policy-configuration-service-provider.md)

Added the following new policies for Windows 10, version 1709:

diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index f3da2fb6fe..01bd1dd68e 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -60,6 +60,7 @@ This policy setting allows you to enable or disable Microsoft Application Virtua ADMX Info: - GP english name: *Enable App-V Client* - GP name: *EnableAppV* +- GP path: *Administrative Templates/System/App-V* - GP ADMX file name: *appv.admx* @@ -105,6 +106,7 @@ Enables Dynamic Virtualization of supported shell extensions, browser helper obj ADMX Info: - GP english name: *Enable Dynamic Virtualization* - GP name: *Virtualization_JITVEnable* +- GP path: *Administrative Templates/System/App-V/Virtualization* - GP ADMX file name: *appv.admx* @@ -150,6 +152,7 @@ Enables automatic cleanup of appv packages that were added after Windows10 anniv ADMX Info: - GP english name: *Enable automatic cleanup of unused appv packages* - GP name: *PackageManagement_AutoCleanupEnable* +- GP path: *Administrative Templates/System/App-V/PackageManagement* - GP ADMX file name: *appv.admx* @@ -195,6 +198,7 @@ Enables scripts defined in the package manifest of configuration files that shou ADMX Info: - GP english name: *Enable Package Scripts* - GP name: *Scripting_Enable_Package_Scripts* +- GP path: *Administrative Templates/System/App-V/Scripting* - GP ADMX file name: *appv.admx* @@ -240,6 +244,7 @@ Enables a UX to display to the user when a publishing refresh is performed on th ADMX Info: - GP english name: *Enable Publishing Refresh UX* - GP name: *Enable_Publishing_Refresh_UX* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -295,6 +300,7 @@ Data Block Size: This value specifies the maximum size in bytes to transmit to t ADMX Info: - GP english name: *Reporting Server* - GP name: *Reporting_Server_Policy* +- GP path: *Administrative Templates/System/App-V/Reporting* - GP ADMX file name: *appv.admx* @@ -340,6 +346,7 @@ Specifies the file paths relative to %userprofile% that do not roam with a user' ADMX Info: - GP english name: *Roaming File Exclusions* - GP name: *Integration_Roaming_File_Exclusions* +- GP path: *Administrative Templates/System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -385,6 +392,7 @@ Specifies the registry paths that do not roam with a user profile. Example usage ADMX Info: - GP english name: *Roaming Registry Exclusions* - GP name: *Integration_Roaming_Registry_Exclusions* +- GP path: *Administrative Templates/System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -430,6 +438,7 @@ Specifies how new packages should be loaded automatically by App-V on a specific ADMX Info: - GP english name: *Specify what to load in background (aka AutoLoad)* - GP name: *Steaming_Autoload* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -475,6 +484,7 @@ Migration mode allows the App-V client to modify shortcuts and FTA's for package ADMX Info: - GP english name: *Enable Migration Mode* - GP name: *Client_Coexistence_Enable_Migration_mode* +- GP path: *Administrative Templates/System/App-V/Client Coexistence* - GP ADMX file name: *appv.admx* @@ -520,6 +530,7 @@ Specifies the location where symbolic links are created to the current version o ADMX Info: - GP english name: *Integration Root User* - GP name: *Integration_Root_User* +- GP path: *Administrative Templates/System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -565,6 +576,7 @@ Specifies the location where symbolic links are created to the current version o ADMX Info: - GP english name: *Integration Root Global* - GP name: *Integration_Root_Global* +- GP path: *Administrative Templates/System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -628,6 +640,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: - GP english name: *Publishing Server 1 Settings* - GP name: *Publishing_Server1_Policy* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -689,8 +702,9 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: -- GP english name: *Publishing Server 2 Settings* +- GP English name: *Publishing Server 2 Settings* - GP name: *Publishing_Server2_Policy* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -754,6 +768,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: - GP english name: *Publishing Server 3 Settings* - GP name: *Publishing_Server3_Policy* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -817,6 +832,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: - GP english name: *Publishing Server 4 Settings* - GP name: *Publishing_Server4_Policy* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -880,6 +896,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: - GP english name: *Publishing Server 5 Settings* - GP name: *Publishing_Server5_Policy* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -925,6 +942,7 @@ Specifies the path to a valid certificate in the certificate store. ADMX Info: - GP english name: *Certificate Filter For Client SSL* - GP name: *Streaming_Certificate_Filter_For_Client_SSL* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -970,6 +988,7 @@ This setting controls whether virtualized applications are launched on Windows 8 ADMX Info: - GP english name: *Allow First Time Application Launches if on a High Cost Windows 8 Metered Connection* - GP name: *Streaming_Allow_High_Cost_Launch* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1015,6 +1034,7 @@ Specifies the CLSID for a compatible implementation of the IAppvPackageLocationP ADMX Info: - GP english name: *Location Provider* - GP name: *Streaming_Location_Provider* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1060,6 +1080,7 @@ Specifies directory where all new applications and updates will be installed. ADMX Info: - GP english name: *Package Installation Root* - GP name: *Streaming_Package_Installation_Root* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1105,6 +1126,7 @@ Overrides source location for downloading package content. ADMX Info: - GP english name: *Package Source Root* - GP name: *Streaming_Package_Source_Root* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1150,6 +1172,7 @@ Specifies the number of seconds between attempts to reestablish a dropped sessio ADMX Info: - GP english name: *Reestablishment Interval* - GP name: *Streaming_Reestablishment_Interval* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1195,6 +1218,7 @@ Specifies the number of times to retry a dropped session. ADMX Info: - GP english name: *Reestablishment Retries* - GP name: *Streaming_Reestablishment_Retries* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1240,6 +1264,7 @@ Specifies that streamed package contents will be not be saved to the local hard ADMX Info: - GP english name: *Shared Content Store (SCS) mode* - GP name: *Streaming_Shared_Content_Store_Mode* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1285,6 +1310,7 @@ If enabled, the App-V client will support BrancheCache compatible HTTP streaming ADMX Info: - GP english name: *Enable Support for BranchCache* - GP name: *Streaming_Support_Branch_Cache* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1330,6 +1356,7 @@ Verifies Server certificate revocation status before streaming using HTTPS. ADMX Info: - GP english name: *Verify certificate revocation list* - GP name: *Streaming_Verify_Certificate_Revocation_List* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1375,6 +1402,7 @@ Specifies a list of process paths (may contain wildcards) which are candidates f ADMX Info: - GP english name: *Virtual Component Process Allow List* - GP name: *Virtualization_JITVAllowList* +- GP path: *Administrative Templates/System/App-V/Virtualization* - GP ADMX file name: *appv.admx* diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index f4b6271552..a1cd701480 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -97,7 +97,7 @@ Appv.admx file: ## ADMX-backed policy examples -The following SyncML examples describe how to set a MDM policy that is defined by an ADMX template, specifically the Publishing_Server2_Policy Group Policy description in the application virtualization ADMX file, appv.admx. Note that the functionality that this Group Policy manages is not important; it is used to illustrate only how an MDM ISV can set an ADMX-backed policy. These SyncML examples illustrate common options and the corresponding SyncML code that can be used for testing your policies. Note that the payload of the SyncML must be XML-encoded; for this XML encoding, you can use the [Coder’s Toolbox](http://coderstoolbox.net/string/#!encoding=xml&action=encode&charset=us_ascii) online tool. To avoid encoding the payload, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +The following SyncML examples describe how to set a MDM policy that is defined by an ADMX template, specifically the Publishing_Server2_Policy Group Policy description in the application virtualization ADMX file, appv.admx. Note that the functionality that this Group Policy manages is not important; it is used to illustrate only how an MDM ISV can set an ADMX-backed policy. These SyncML examples illustrate common options and the corresponding SyncML code that can be used for testing your policies. Note that the payload of the SyncML must be XML-encoded; for this XML encoding, you can use favorite online tool. To avoid encoding the payload, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). ### Enabling a policy @@ -119,7 +119,7 @@ The following SyncML examples describe how to set a MDM policy that is defined b **Request SyncML** ```XML - + 2 @@ -169,7 +169,7 @@ The following SyncML examples describe how to set a MDM policy that is defined b **Request SyncML** ```XML - + 2 @@ -209,7 +209,7 @@ The following SyncML examples describe how to set a MDM policy that is defined b **Request SyncML** ``` - + 1 @@ -292,7 +292,7 @@ The `text` element simply corresponds to a string and correspondingly to an edit ```XML - + $CmdId$ @@ -333,7 +333,7 @@ The `multiText` element simply corresponds to a REG_MULTISZ registry string and ```XML - + 2 @@ -377,7 +377,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar #### Corresponding SyncML: ```XML - + 2 @@ -409,7 +409,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar #### Corresponding SyncML: ```XML - + 2 @@ -466,7 +466,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar #### Corresponding SyncML: ```XML - + 2 @@ -503,7 +503,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar #### Corresponding SyncML: ```XML - + 2 @@ -552,7 +552,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ```XML - + 2 diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md index 6b3f009321..390575abd4 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md @@ -46,6 +46,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you - mshta.exe - ntsd.exe - rcsi.exe +- SyncAppVPublishingServer.exe - system.management.automation.dll - windbg.exe @@ -64,6 +65,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you |Matt Nelson | @enigma0x3| |Oddvar Moe |@Oddvarmoe| |Alex Ionescu | @aionescu| +|Nick Landers | @monoxgas|
@@ -116,6 +118,7 @@ Microsoft recommends that you block the following Microsoft-signed applications + @@ -184,6 +187,7 @@ Microsoft recommends that you block the following Microsoft-signed applications + diff --git a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md index 34e836f47e..2232344229 100644 --- a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -117,10 +117,12 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the sc qc diagtrack ``` -## Windows Defender signature updates are configured -The Windows Defender ATP agent depends on Windows Defender’s ability to scan files and provide information about them. If Windows Defender is not the active antimalware in your organization, you may need to configure the signature updates. For more information see [Configure Windows Defender in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md). +## Windows Defender Antivirus signature updates are configured +The Windows Defender ATP agent depends on the ability of Windows Defender Antivirus to scan files and provide information about them. If Windows Defender Antivirus is not the active antimalware in your organization, you may need to configure the signature updates. For more information see [Configure Windows Defender Antivirus in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md). -When Windows Defender is not the active antimalware in your organization and you use the Windows Defender ATP service, Windows Defender goes on passive mode. For more information, see the **Compatibility** section in the [Windows Defender in Windows 10 topic](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md). +When Windows Defender Antivirus is not the active antimalware in your organization and you use the Windows Defender ATP service, Windows Defender Antivirus goes on passive mode. If your organization has disabled Windows Defender Antivirus through group policy or other methods, machines that are onboarded to Windows Defender ATP must be excluded from this group policy. + +For more information, see the **Compatibility** section in the [Windows Defender in Windows 10 topic](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md). ## Windows Defender Early Launch Antimalware (ELAM) driver is enabled If you're running Windows Defender as the primary antimalware product on your endpoints, the Windows Defender ATP agent will successfully onboard.