mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge branch 'master' into MDBranchPhase1ADMXBackedPoliciesSet2
This commit is contained in:
ManikaDhiman
commit
ff66bba40f
@ -148,7 +148,7 @@
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md",
|
||||
"redirect_url": "https://docs.microsoft.com/microsoft-365/security/mtp/top-scoring-industry-tests",
|
||||
"redirect_document_id": true
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks.md",
|
||||
@ -15533,7 +15533,7 @@
|
||||
{
|
||||
"source_path": "education/get-started/change-history-ms-edu-get-started.md",
|
||||
"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy",
|
||||
"redirect_document_id": true
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "education/get-started/get-started-with-microsoft-education.md",
|
||||
|
||||
@ -30,6 +30,7 @@
|
||||
"externalReference": [],
|
||||
"globalMetadata": {
|
||||
"breadcrumb_path": "/windows/smb/breadcrumb/toc.json",
|
||||
"uhfHeaderId": "MSDocsHeader-M365-IT",
|
||||
"feedback_system": "None",
|
||||
"hideEdit": true,
|
||||
"_op_documentIdPathDepotMapping": {
|
||||
|
||||
@ -32,7 +32,7 @@ From its release, Windows 10 has supported remote connections to PCs joined to A
|
||||
## Set up
|
||||
|
||||
- Both PCs (local and remote) must be running Windows 10, version 1607 or later. Remote connections to an Azure AD-joined PC running earlier versions of Windows 10 are not supported.
|
||||
- Your local PC (where you are connecting from) must be either Azure AD joined or Hybrid Azure AD joined. Remote connections to an Azure AD joined PC from an unjoined device or a non-Windows 10 device are not supported.
|
||||
- Your local PC (where you are connecting from) must be either Azure AD joined or Hybrid Azure AD joined if using Windows 10 version 1607 and above, or Azure AD registered if using Windows 10 version 2004 and above. Remote connections to an Azure AD joined PC from an unjoined device or a non-Windows 10 device are not supported.
|
||||
|
||||
Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC you are using to connect to the remote PC.
|
||||
|
||||
@ -99,4 +99,3 @@ In organizations using only Azure AD, you can connect from an Azure AD-joined PC
|
||||
## Related topics
|
||||
|
||||
[How to use Remote Desktop](https://support.microsoft.com/instantanswers/ff521c86-2803-4bc0-a5da-7df445788eb9/how-to-use-remote-desktop)
|
||||
|
||||
|
||||
@ -737,7 +737,7 @@ The following list shows the supported values for Windows 8.1:
|
||||
|
||||
In Windows 10, you can configure this policy setting to decide what level of diagnostic data to send to Microsoft. The following list shows the supported values for Windows 10:
|
||||
- 0 – (**Security**) Sends information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Microsoft Defender.
|
||||
**Note:** This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1.
|
||||
**Note:** This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), Hololens 2, and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1.
|
||||
- 1 – (**Basic**) Sends the same data as a value of 0, plus additional basic device info, including quality-related data, app compatibility, and app usage data.
|
||||
- 2 – (**Enhanced**) Sends the same data as a value of 1, plus additional insights, including how Windows, Windows Server, System Center, and apps are used, how they perform, and advanced reliability data.
|
||||
- 3 – (**Full**) Sends the same data as a value of 2, plus all data necessary to identify and fix problems with devices.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Update baseline
|
||||
title: Update Baseline
|
||||
description: Use an update baseline to optimize user experience and meet monthly update goals
|
||||
keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, tools, group policy
|
||||
ms.prod: w10
|
||||
@ -11,7 +11,7 @@ manager: laurawi
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Update baseline
|
||||
# Update Baseline
|
||||
|
||||
**Applies to:** Windows 10
|
||||
|
||||
|
||||
@ -17,6 +17,7 @@
|
||||
"ROBOTS": "INDEX, FOLLOW",
|
||||
"audience": "ITPro",
|
||||
"breadcrumb_path": "/itpro/windows/breadcrumb/toc.json",
|
||||
"uhfHeaderId": "MSDocsHeader-M365-IT",
|
||||
"_op_documentIdPathDepotMapping": {
|
||||
"./": {
|
||||
"depot_name": "Win.windows"
|
||||
|
||||
14
windows/security/includes/microsoft-defender.md
Normal file
14
windows/security/includes/microsoft-defender.md
Normal file
@ -0,0 +1,14 @@
|
||||
---
|
||||
title: Microsoft Defender rebrand guidance
|
||||
description: A note in regard to the Microsoft Defender rebrand.
|
||||
ms.date: 09/21/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: daniha
|
||||
author: danihalfin
|
||||
ms.prod: w10
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Welcome to **Microsoft Defender for Endpoint**, the new name for **Microsoft Defender Advanced Threat Protection**. Read more about this and other updates [here](https://www.microsoft.com/security/blog/?p=91813). We'll be updating names in products and in the docs in the near future.
|
||||
@ -26,18 +26,23 @@
|
||||
|
||||
|
||||
## [Migration guides](microsoft-defender-atp/migration-guides.md)
|
||||
### [Switch from McAfee to Microsoft Defender ATP]()
|
||||
#### [Get an overview of migration](microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md)
|
||||
#### [Prepare for your migration](microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md)
|
||||
#### [Set up Microsoft Defender ATP](microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md)
|
||||
#### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md)
|
||||
### [Switch from Symantec to Microsoft Defender ATP]()
|
||||
#### [Get an overview of migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md)
|
||||
#### [Prepare for your migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md)
|
||||
#### [Set up Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md)
|
||||
#### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md)
|
||||
### [Manage Microsoft Defender ATP after migration]()
|
||||
#### [Overview](microsoft-defender-atp/manage-atp-post-migration.md)
|
||||
### [Switch from McAfee to Microsoft Defender for Endpoint]()
|
||||
#### [Overview of migration](microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md)
|
||||
#### [Phase 1: Prepare](microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md)
|
||||
#### [Phase 2: Setup](microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md)
|
||||
#### [Phase 3: Onboard](microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md)
|
||||
### [Switch from Symantec to Microsoft Defender for Endpoint]()
|
||||
#### [Overview of migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md)
|
||||
#### [Phase 1: Prepare](microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md)
|
||||
#### [Phase 2: Setup](microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md)
|
||||
#### [Phase 3: Onboard](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md)
|
||||
### [Switch from your non-Microsoft endpoint security solution to Microsoft Defender for Endpoint]()
|
||||
#### [Overview of migration](microsoft-defender-atp/switch-to-microsoft-defender-migration.md)
|
||||
#### [Phase 1: Prepare](microsoft-defender-atp/switch-to-microsoft-defender-prepare.md)
|
||||
#### [Phase 2: Setup](microsoft-defender-atp/switch-to-microsoft-defender-setup.md)
|
||||
#### [Phase 3: Onboard](microsoft-defender-atp/switch-to-microsoft-defender-onboard.md)
|
||||
### [Manage Microsoft Defender for Endpoint after migration]()
|
||||
#### [Overview of managing Microsoft Defender for Endpoint](microsoft-defender-atp/manage-atp-post-migration.md)
|
||||
#### [Intune (recommended)](microsoft-defender-atp/manage-atp-post-migration-intune.md)
|
||||
#### [Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md)
|
||||
#### [Group Policy Objects](microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md)
|
||||
@ -251,6 +256,10 @@
|
||||
#### [Resources](microsoft-defender-atp/mac-resources.md)
|
||||
|
||||
|
||||
### [Microsoft Defender Advanced Threat Protection for iOS]()
|
||||
#### [Overview of Microsoft Defender Advanced Threat Protection for iOS](microsoft-defender-atp/microsoft-defender-atp-ios.md)
|
||||
|
||||
|
||||
### [Microsoft Defender Advanced Threat Protection for Linux]()
|
||||
#### [Overview of Microsoft Defender ATP for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md)
|
||||
#### [What's New](microsoft-defender-atp/linux-whatsnew.md)
|
||||
@ -287,6 +296,11 @@
|
||||
#### [Configure]()
|
||||
##### [Configure Microsoft Defender ATP for Android features](microsoft-defender-atp/android-configure.md)
|
||||
|
||||
#### [Privacy]()
|
||||
##### [Microsoft Defender ATP for Android - Privacy information](microsoft-defender-atp/android-privacy.md)
|
||||
|
||||
#### [Troubleshoot]()
|
||||
##### [Troubleshoot issues](microsoft-defender-atp/android-support-signin.md)
|
||||
|
||||
|
||||
### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md)
|
||||
@ -358,12 +372,6 @@
|
||||
##### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md)
|
||||
#### [Device health and compliance reports](microsoft-defender-atp/machine-reports.md)
|
||||
|
||||
|
||||
#### [Custom detections]()
|
||||
##### [Custom detections overview](microsoft-defender-atp/overview-custom-detections.md)
|
||||
##### [Create detection rules](microsoft-defender-atp/custom-detection-rules.md)
|
||||
##### [View & manage detection rules](microsoft-defender-atp/custom-detections-manage.md)
|
||||
|
||||
### [Behavioral blocking and containment]()
|
||||
#### [Behavioral blocking and containment](microsoft-defender-atp/behavioral-blocking-containment.md)
|
||||
#### [Client behavioral blocking](microsoft-defender-atp/client-behavioral-blocking.md)
|
||||
@ -376,10 +384,15 @@
|
||||
|
||||
### [Advanced hunting]()
|
||||
#### [Advanced hunting overview](microsoft-defender-atp/advanced-hunting-overview.md)
|
||||
#### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md)
|
||||
#### [Learn, train, & get examples]()
|
||||
##### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md)
|
||||
##### [Use shared queries](microsoft-defender-atp/advanced-hunting-shared-queries.md)
|
||||
#### [Work with query results](microsoft-defender-atp/advanced-hunting-query-results.md)
|
||||
#### [Use shared queries](microsoft-defender-atp/advanced-hunting-shared-queries.md)
|
||||
#### [Advanced hunting schema reference]()
|
||||
#### [Optimize & handle errors]()
|
||||
##### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md)
|
||||
##### [Handle errors](microsoft-defender-atp/advanced-hunting-errors.md)
|
||||
##### [Service limits](microsoft-defender-atp/advanced-hunting-limits.md)
|
||||
#### [Data schema]()
|
||||
##### [Understand the schema](microsoft-defender-atp/advanced-hunting-schema-reference.md)
|
||||
##### [DeviceAlertEvents](microsoft-defender-atp/advanced-hunting-devicealertevents-table.md)
|
||||
##### [DeviceFileEvents](microsoft-defender-atp/advanced-hunting-devicefileevents-table.md)
|
||||
@ -396,7 +409,10 @@
|
||||
##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md)
|
||||
#### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md)
|
||||
#### [Custom detections]()
|
||||
##### [Custom detections overview](microsoft-defender-atp/overview-custom-detections.md)
|
||||
##### [Create detection rules](microsoft-defender-atp/custom-detection-rules.md)
|
||||
##### [View & manage detection rules](microsoft-defender-atp/custom-detections-manage.md)
|
||||
|
||||
### [Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md)
|
||||
|
||||
@ -634,6 +650,7 @@
|
||||
|
||||
#### [Managed security service provider (MSSP) integration]()
|
||||
##### [Configure managed security service provider integration](microsoft-defender-atp/configure-mssp-support.md)
|
||||
##### [Supported managed security service providers](microsoft-defender-atp/mssp-list.md)
|
||||
##### [Grant MSSP access to the portal](microsoft-defender-atp/grant-mssp-access.md)
|
||||
##### [Access the MSSP customer portal](microsoft-defender-atp/access-mssp-portal.md)
|
||||
##### [Configure alert notifications](microsoft-defender-atp/configure-mssp-notifications.md)
|
||||
@ -671,8 +688,12 @@
|
||||
#### [Troubleshoot Microsoft Defender ATP service issues]()
|
||||
##### [Troubleshoot service issues](microsoft-defender-atp/troubleshoot-mdatp.md)
|
||||
##### [Check service health](microsoft-defender-atp/service-status.md)
|
||||
##### [Contact Microsoft Defender ATP support](microsoft-defender-atp/contact-support.md)
|
||||
|
||||
|
||||
#### [Troubleshoot live response issues](microsoft-defender-atp/troubleshoot-live-response.md)
|
||||
|
||||
#### [Collect support logs using LiveAnalyzer ](microsoft-defender-atp/troubleshoot-collect-support-log.md)
|
||||
|
||||
#### [Troubleshoot attack surface reduction issues]()
|
||||
##### [Network protection](microsoft-defender-atp/troubleshoot-np.md)
|
||||
|
||||
@ -20,6 +20,9 @@ ms.topic: article
|
||||
|
||||
# What to do with false positives/negatives in Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Collect Update Compliance diagnostic data for Microsoft Defender AV Assessment
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Collect Microsoft Defender AV diagnostic data
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -17,6 +17,9 @@ ms.date: 08/17/2020
|
||||
|
||||
# Configure and manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line tool
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -16,6 +16,9 @@ manager: dansimp
|
||||
---
|
||||
|
||||
# Common mistakes to avoid when defining exclusions
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
You can define an exclusion list for items that you don't want Microsoft Defender Antivirus to scan. Such excluded items could contain threats that make your device vulnerable.
|
||||
|
||||
This topic describes some common mistake that you should avoid when defining exclusions.
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Manage Microsoft Defender Antivirus in your business
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Configure Microsoft Defender Antivirus scanning options
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -17,6 +17,9 @@ ms.date: 08/26/2020
|
||||
|
||||
# Turn on block at first sight
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Configure the cloud block timeout period
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
|
||||
# Configure end-user interaction with Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
|
||||
# Configure and validate exclusions for Microsoft Defender Antivirus scans
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
@ -45,4 +48,4 @@ The following is a list of recommendations that you should keep in mind when def
|
||||
## Related articles
|
||||
|
||||
- [Microsoft Defender Antivirus exclusions on Windows Server 2016](configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md)
|
||||
- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md)
|
||||
|
||||
@ -16,6 +16,9 @@ manager: dansimp
|
||||
|
||||
# Configure and validate exclusions based on file extension and folder location
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Prevent or allow users to locally modify Microsoft Defender Antivirus policy settings
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Configure Microsoft Defender Antivirus features
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Configure and validate Microsoft Defender Antivirus network connections
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Configure the notifications that appear on endpoints
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
|
||||
# Configure exclusions for files opened by processes
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Configure behavioral, heuristic, and real-time protection
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ ms.custom: nextgen
|
||||
|
||||
# Enable and configure Microsoft Defender Antivirus always-on protection in Group Policy
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Configure remediation for Microsoft Defender Antivirus scans
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -17,6 +17,9 @@ ms.custom: nextgen
|
||||
|
||||
# Configure Microsoft Defender Antivirus exclusions on Windows Server
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
Microsoft Defender Antivirus on Windows Server 2016 and 2019 automatically enrolls you in certain exclusions, as defined by your specified server role. See the [list of automatic exclusions](#list-of-automatic-exclusions) (in this article). These exclusions do not appear in the standard exclusion lists that are shown in the [Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions).
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Deploy, manage, and report on Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Deploy and enable Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
|
||||
# Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
@ -44,69 +47,11 @@ You can also download the whitepaper [Microsoft Defender Antivirus on Virtual De
|
||||
> [!IMPORTANT]
|
||||
> Although the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows.<br/>There are performance and feature improvements to the way in which Microsoft Defender AV operates on virtual machines in Windows 10 Insider Preview, build 18323 (and later). We'll identify in this guide if you need to be using an Insider Preview build; if it isn't specified, then the minimum required version for the best protection and performance is Windows 10 1607.
|
||||
|
||||
### Set up a dedicated VDI file share
|
||||
## Set up a dedicated VDI file share
|
||||
|
||||
In Windows 10, version 1903, we introduced the shared security intelligence feature. This offloads the unpackaging of downloaded security intelligence updates onto a host machine - thus saving previous CPU, disk, and memory resources on individual machines. You can set this feature with [Intune](https://docs.microsoft.com/intune/fundamentals/what-is-intune), Group Policy, or PowerShell.
|
||||
In Windows 10, version 1903, we introduced the shared security intelligence feature. This offloads the unpackaging of downloaded security intelligence updates onto a host machine — thus saving previous CPU, disk, and memory resources on individual machines. You can set this feature with a Group Policy, or PowerShell.
|
||||
|
||||
> [!TIP]
|
||||
> If you don't already have Intune, [try it for free](https://docs.microsoft.com/intune/fundamentals/free-trial-sign-up)!
|
||||
|
||||
Open the Intune Management Portal either by searching for Intune on [https://portal.azure.com](https://portal.azure.com) or going to [https://devicemanagement.microsoft.com](https://devicemanagement.microsoft.com) and logging in.
|
||||
|
||||
#### To create a group with only the devices or users you specify
|
||||
|
||||
1. Go to **Groups** > **New group**.
|
||||
|
||||
2. Specify the following values:
|
||||
- Group type: **Security**
|
||||
- Group name: **VDI test VMs**
|
||||
- Group description: *Optional*
|
||||
- Membership type: **Assigned**
|
||||
|
||||
3. Add the devices or users you want to be a part of this test and then click **Create** to save the group.
|
||||
|
||||
It’s a good idea to create a couple of groups, one with VMs running the latest Insider Preview build and with the shared security intelligence update feature enabled, and another with VMs that are running Windows 10 1809 or earlier versions. This will help when you create dashboards to test the performance changes.
|
||||
|
||||
#### To create a group that will include any machine in your tenant that is a VM, even when they are newly created
|
||||
|
||||
1. Go to **Groups** > **New group**.
|
||||
|
||||
2. Specify the following values:
|
||||
- Group type: **Security**
|
||||
- Group name: **VDI test VMs**
|
||||
- Group description: *Optional*
|
||||
- Membership type: **Dynamic Device**
|
||||
|
||||
3. Click **Simple rule**, and select **deviceModel**, **Equals**, and enter **Virtual Machine**.
|
||||
|
||||
4. Click **Add query** and then **Create** to save the group.
|
||||
|
||||
5. Go to **Device configuration**, then **Profiles**. You can modify an existing custom profile or create a new one.
|
||||
|
||||
#### Create a new device configuration profile
|
||||
|
||||
In this example, we create a new device configuration profile by clicking **Create profile**.
|
||||
|
||||
1. Name it, choose **Windows 10 and later** as the Platform and – most importantly – select **Custom** as the profile type.
|
||||
|
||||
2. The **Custom OMA-URI Settings** blade is opened automatically. Click **Add** then enter the following values:
|
||||
- Name: **VDI shared sig location**
|
||||
- Description: *Optional*
|
||||
- OMA-URI: **./Vendor/MSFT/Defender/SharedSignatureRoot**
|
||||
- Data type: **String**
|
||||
- `\\<sharedlocation\>\wdav-update\` (see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be)
|
||||
|
||||
3. Click **Ok** to close the details blade, then **OK** again to close the **Custom OMA-URI Settings** blade.
|
||||
|
||||
4. Click **Create** to save the new profile. The profile details page now appears.
|
||||
|
||||
5. Click **Assignments**. The **Include** tab is automatically selected. In the drop-down menu, select **Selected Groups**, then click **Select groups to include**. Click the **VDI test VMs** group and then **Select**.
|
||||
|
||||
6. Click **Evaluate** to see how many users/devices will be impacted. If the number makes sense, click **Save**. If the number doesn’t make sense, go back to the groups blade and confirm the group contains the right users or devices.
|
||||
|
||||
The profile will now be deployed to the impacted devices. This may take some time.
|
||||
|
||||
#### Use Group Policy to enable the shared security intelligence feature:
|
||||
### Use Group Policy to enable the shared security intelligence feature:
|
||||
|
||||
1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure, and then click **Edit**.
|
||||
|
||||
@ -118,23 +63,23 @@ The profile will now be deployed to the impacted devices. This may take some tim
|
||||
|
||||
5. Double-click **Define security intelligence location for VDI clients**, and then set the option to **Enabled**. A field automatically appears.
|
||||
|
||||
6. Enter `\\<sharedlocation\>\wdav-update` (see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be).
|
||||
6. Enter `\\<sharedlocation\>\wdav-update` (for what this will be, see [Download and unpackage](#download-and-unpackage-the-latest-updates)).
|
||||
|
||||
7. Click **OK**.
|
||||
|
||||
8. Deploy the GPO to the VMs you want to test.
|
||||
|
||||
#### Use PowerShell to enable the shared security intelligence feature
|
||||
### Use PowerShell to enable the shared security intelligence feature
|
||||
|
||||
Use the following cmdlet to enable the feature. You’ll need to then push this as you normally would push PowerShell-based configuration policies onto the VMs:
|
||||
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -SharedSignaturesPath \\<shared location>\wdav-update
|
||||
```
|
||||
|
||||
See the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what the \<shared location\> will be.
|
||||
|
||||
### Download and unpackage the latest updates
|
||||
## Download and unpackage the latest updates
|
||||
|
||||
Now you can get started on downloading and installing new updates. We’ve created a sample PowerShell script for you below. This script is the easiest way to download new updates and get them ready for your VMs. You should then set the script to run at a certain time on the management machine by using a scheduled task (or, if you’re familiar with using PowerShell scripts in Azure, Intune, or SCCM, you could also use those).
|
||||
|
||||
@ -149,30 +94,29 @@ New-Item -ItemType Directory -Force -Path $vdmpath | Out-Null
|
||||
|
||||
Invoke-WebRequest -Uri 'https://go.microsoft.com/fwlink/?LinkID=121721&arch=x64' -OutFile $vdmpackage
|
||||
|
||||
cmd /c "cd $vdmpath & c: & mpam-fe.exe /x"
|
||||
cmd /c "cd $vdmpath & c: & mpam-fe.exe /x"
|
||||
```
|
||||
|
||||
You can set a scheduled task to run once a day so that whenever the package is downloaded and unpacked then the VMs will receive the new update.
|
||||
We suggest starting with once a day – but you should experiment with increasing or decreasing the frequency to understand the impact.
|
||||
We suggest starting with once a day — but you should experiment with increasing or decreasing the frequency to understand the impact.
|
||||
|
||||
Security intelligence packages are typically published once every three to four hours. Setting a frequency shorter than four hours isn’t advised because it will increase the network overhead on your management machine for no benefit.
|
||||
|
||||
#### Set a scheduled task to run the powershell script
|
||||
### Set a scheduled task to run the PowerShell script
|
||||
|
||||
1. On the management machine, open the Start menu and type **Task Scheduler**. Open it and select **Create task…** on the side panel.
|
||||
|
||||
2. Enter the name as **Security intelligence unpacker**. Go to the **Trigger** tab. Click **New…** Select **Daily** and click **OK**.
|
||||
|
||||
3. Go to the **Actions** tab. Click **New…** Enter **PowerShell** in the **Program/Script** field. Enter `-ExecutionPolicy Bypass c:\wdav-update\vdmdlunpack.ps1` in the **Add arguments** field. Click **OK**.
|
||||
3. Go to the **Actions** tab. Click **New…** Enter **PowerShell** in the **Program/Script** field. Enter `-ExecutionPolicy Bypass c:\wdav-update\vdmdlunpack.ps1` in the **Add arguments** field. Click **OK**.
|
||||
|
||||
4. You can choose to configure additional settings if you wish.
|
||||
4. You can choose to configure additional settings if you wish.
|
||||
|
||||
5. Click **OK** to save the scheduled task.
|
||||
|
||||
|
||||
You can initiate the update manually by right-clicking on the task and clicking **Run**.
|
||||
|
||||
#### Download and unpackage manually
|
||||
### Download and unpackage manually
|
||||
|
||||
If you would prefer to do everything manually, this what you would need to do to replicate the script’s behavior:
|
||||
|
||||
@ -180,83 +124,85 @@ If you would prefer to do everything manually, this what you would need to do to
|
||||
|
||||
2. Create a subfolder under *wdav_update* with a GUID name, such as `{00000000-0000-0000-0000-000000000000}`; for example `c:\wdav_update\{00000000-0000-0000-0000-000000000000}`.
|
||||
|
||||
Note: In the script we set it so the last 12 digits of the GUID are the year, month, day, and time when the file was downloaded so that a new folder is created each time. You can change this so that the file is downloaded to the same folder each time.
|
||||
> [!NOTE]
|
||||
> In the script we set it so the last 12 digits of the GUID are the year, month, day, and time when the file was downloaded so that a new folder is created each time. You can change this so that the file is downloaded to the same folder each time.
|
||||
|
||||
3. Download a security intelligence package from [https://www.microsoft.com/wdsi/definitions](https://www.microsoft.com/wdsi/definitions) into the GUID folder. The file should be named `mpam-fe.exe`.
|
||||
|
||||
4. Open a cmd prompt window and navigate to the GUID folder you created. Use the **/X** extraction command to extract the files, for example `mpam-fe.exe /X`.
|
||||
|
||||
Note: The VMs will pick up the updated package whenever a new GUID folder is created with an extracted update package or whenever an existing folder is updated with a new extracted package.
|
||||
> [!NOTE]
|
||||
> The VMs will pick up the updated package whenever a new GUID folder is created with an extracted update package or whenever an existing folder is updated with a new extracted package.
|
||||
|
||||
### Randomize scheduled scans
|
||||
## Randomize scheduled scans
|
||||
|
||||
Scheduled scans run in addition to [real-time protection and scanning](configure-real-time-protection-microsoft-defender-antivirus.md).
|
||||
|
||||
The start time of the scan itself is still based on the scheduled scan policy – ScheduleDay, ScheduleTime, ScheduleQuickScanTime. Randomization will cause Microsoft Defender AV to start a scan on each machine within a 4 hour window from the time set for the scheduled scan.
|
||||
The start time of the scan itself is still based on the scheduled scan policy — ScheduleDay, ScheduleTime, ScheduleQuickScanTime. Randomization will cause Microsoft Defender AV to start a scan on each machine within a 4 hour window from the time set for the scheduled scan.
|
||||
|
||||
See [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) for other configuration options available for scheduled scans.
|
||||
|
||||
### Use quick scans
|
||||
## Use quick scans
|
||||
|
||||
You can specify the type of scan that should be performed during a scheduled scan.
|
||||
Quick scans are the preferred approach as they are designed to look in all places where malware needs to reside to be active.
|
||||
|
||||
1. Expand the tree to **Windows components > Windows Defender > Scan**.
|
||||
|
||||
2. Double-click **Specify the scan type to use for a scheduled scan** and set the option to **Enabled** and **Quick scan**.
|
||||
2. Double-click **Specify the scan type to use for a scheduled scan** and set the option to **Enabled** and **Quick scan**.
|
||||
|
||||
3. Click **OK**.
|
||||
|
||||
### Prevent notifications
|
||||
## Prevent notifications
|
||||
|
||||
Sometimes, Microsoft Defender Antivirus notifications may be sent to or persist across multiple sessions. In order to minimize this problem, you can use the lock down the Microsoft Defender Antivirus user interface.
|
||||
|
||||
1. Expand the tree to **Windows components > Windows Defender > Client Interface**.
|
||||
1. Expand the tree to **Windows components > Windows Defender > Client Interface**.
|
||||
|
||||
2. Double-click **Suppress all notifications** and set the option to **Enabled**.
|
||||
2. Double-click **Suppress all notifications** and set the option to **Enabled**.
|
||||
|
||||
3. Click **OK**.
|
||||
3. Click **OK**.
|
||||
|
||||
This prevents notifications from Microsoft Defender AV appearing in the action center on Windows 10 when scans or remediation is performed.
|
||||
|
||||
### Disable scans after an update
|
||||
## Disable scans after an update
|
||||
|
||||
This setting will prevent a scan from occurring after receiving an update. You can apply this when creating the base image if you have also run a quick scan. This prevents the newly updated VM from performing a scan again (as you've already scanned it when you created the base image).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Running scans after an update will help ensure your VMs are protected with the latest Security intelligence updates. Disabling this option will reduce the protection level of your VMs and should only be used when first creating or deploying the base image.
|
||||
|
||||
1. Expand the tree to **Windows components > Windows Defender > Signature Updates**.
|
||||
1. Expand the tree to **Windows components > Windows Defender > Signature Updates**.
|
||||
|
||||
2. Double-click **Turn on scan after signature update** and set the option to **Disabled**.
|
||||
2. Double-click **Turn on scan after signature update** and set the option to **Disabled**.
|
||||
|
||||
3. Click **OK**.
|
||||
3. Click **OK**.
|
||||
|
||||
This prevents a scan from running immediately after an update.
|
||||
|
||||
### Scan VMs that have been offline
|
||||
## Scan VMs that have been offline
|
||||
|
||||
1. Expand the tree to **Windows components > Windows Defender > Scan**.
|
||||
1. Expand the tree to **Windows components > Windows Defender > Scan**.
|
||||
|
||||
2. Double-click the **Turn on catch-up quick scan** setting and set the option to **Enabled**.
|
||||
2. Double-click the **Turn on catch-up quick scan** setting and set the option to **Enabled**.
|
||||
|
||||
3. Click **OK**.
|
||||
3. Click **OK**.
|
||||
|
||||
This forces a scan if the VM has missed two or more consecutive scheduled scans.
|
||||
|
||||
## Enable headless UI mode
|
||||
|
||||
### Enable headless UI mode
|
||||
1. Double-click **Enable headless UI mode** and set the option to **Enabled**.
|
||||
|
||||
1. Double-click **Enable headless UI mode** and set the option to **Enabled**.
|
||||
|
||||
2. Click **OK**.
|
||||
2. Click **OK**.
|
||||
|
||||
This hides the entire Microsoft Defender AV user interface from users.
|
||||
|
||||
### Exclusions
|
||||
## Exclusions
|
||||
|
||||
On Windows Server 2016, Microsoft Defender Antivirus will automatically deliver the right exclusions for servers running a VDI environment. However, if you are running an older Windows server version, see [Configure Microsoft Defender Antivirus exclusions on Windows Server](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus).
|
||||
Exclusions can be added, removed, or customized to suit your needs.
|
||||
|
||||
For more details, see [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-exclusions-microsoft-defender-antivirus.md).
|
||||
|
||||
## Additional resources
|
||||
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Detect and block potentially unwanted applications
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -16,6 +16,9 @@ ms.custom: nextgen
|
||||
|
||||
# Enable cloud-delivered protection
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
|
||||
# Evaluate Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ manager: dansimp
|
||||
|
||||
# Use limited periodic scanning in Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Manage event-based forced updates
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Manage Microsoft Defender Antivirus updates and scans for endpoints that are out of date
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ manager: dansimp
|
||||
|
||||
# Manage the schedule for when protection updates should be downloaded and applied
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -17,6 +17,9 @@ ms.custom: nextgen
|
||||
|
||||
# Manage the sources for Microsoft Defender Antivirus protection updates
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ ms.date: 09/10/2020
|
||||
|
||||
# Manage Microsoft Defender Antivirus updates and apply baselines
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Manage updates for mobile devices and virtual machines (VMs)
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ ms.date: 08/26/2020
|
||||
|
||||
# Microsoft Defender Antivirus compatibility
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ ms.custom: nextgen
|
||||
|
||||
# Next-generation protection in Windows 10, Windows Server 2016, and Windows Server 2019
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
|
||||
# Microsoft Defender Antivirus on Windows Server 2016 and 2019
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Server 2016
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
|
||||
# Run and review the results of a Microsoft Defender Offline scan
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
|
||||
# Microsoft Defender Antivirus in the Windows Security app
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -20,6 +20,9 @@ manager: dansimp
|
||||
|
||||
# Better together: Microsoft Defender Antivirus and Office 365
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
@ -19,6 +19,9 @@ ms.date: 08/31/2020
|
||||
|
||||
# Protect security settings with tamper protection
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Report on Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Restore quarantined files in Microsoft Defender AV
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Review Microsoft Defender Antivirus scan results
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Configure and run on-demand Microsoft Defender Antivirus scans
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
@ -29,6 +32,9 @@ You can run an on-demand scan on individual endpoints. These scans will start im
|
||||
|
||||
Quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Microsoft Defender Antivirus runs in the context of the [LocalSystem](https://docs.microsoft.com/windows/win32/services/localsystem-account) account when performing a local scan. For network scans, it uses the context of the device account. If the domain device account doesn't have appropriate permissions to access the share, the scan won't work. Ensure that the device has permissions to the access network share.
|
||||
|
||||
Combined with [always-on real-time protection capability](configure-real-time-protection-microsoft-defender-antivirus.md)--which reviews files when they are opened and closed, and whenever a user navigates to a folder--a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware.
|
||||
|
||||
In most instances, this means a quick scan is adequate to find malware that wasn't picked up by real-time protection.
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Configure scheduled quick or full Microsoft Defender Antivirus scans
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ ms.custom: nextgen
|
||||
|
||||
# Specify the cloud-delivered protection level
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
|
||||
# Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
|
||||
# Troubleshoot Microsoft Defender Antivirus reporting in Update Compliance
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
|
||||
# Use Group Policy settings to configure and manage Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Use Microsoft Endpoint Configuration Manager and Microsoft Intune to configure and manage Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Use Windows Management Instrumentation (WMI) to configure and manage Microsoft Defender Antivirus
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -16,6 +16,9 @@ ms.custom: nextgen
|
||||
|
||||
# Use next-generation technologies in Microsoft Defender Antivirus through cloud-delivered protection
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
@ -18,6 +18,9 @@ manager: dansimp
|
||||
|
||||
# Better together: Microsoft Defender Antivirus and Microsoft Defender Advanced Threat Protection
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# Access the Microsoft Defender Security Center MSSP customer portal
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
@ -53,4 +56,4 @@ Use the following steps to obtain the MSSP customer tenant ID and then use the I
|
||||
## Related topics
|
||||
- [Grant MSSP access to the portal](grant-mssp-access.md)
|
||||
- [Configure alert notifications](configure-mssp-notifications.md)
|
||||
- [Fetch alerts from customer tenant](fetch-alerts-mssp.md)
|
||||
- [Fetch alerts from customer tenant](fetch-alerts-mssp.md)
|
||||
|
||||
@ -18,6 +18,9 @@ ms.topic: article
|
||||
|
||||
# Add or Remove Machine Tags API
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# Configure advanced features in Microsoft Defender ATP
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# Advanced hunting query best practices
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -89,4 +92,4 @@ DeviceProcessEvents
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
|
||||
@ -20,6 +20,9 @@ ms.date: 01/22/2020
|
||||
|
||||
# DeviceAlertEvents
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
@ -50,4 +53,4 @@ For information on other tables in the advanced hunting schema, see [the advance
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceEvents
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -20,6 +20,9 @@ ms.date: 01/14/2020
|
||||
|
||||
# DeviceFileCertificateInfo
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
@ -55,4 +58,4 @@ For information on other tables in the advanced hunting schema, see [the advance
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceFileEvents
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceImageLoadEvents
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceInfo
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceLogonEvents
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceNetworkEvents
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
@ -64,4 +67,4 @@ For information on other tables in the advanced hunting schema, see [the advance
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceNetworkInfo
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceProcessEvents
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceRegistryEvents
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceTvmSecureConfigurationAssessment
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceTvmSecureConfigurationAssessmentKB
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceTvmSoftwareInventoryVulnerabilities
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# DeviceTvmSoftwareVulnerabilitiesKB
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -0,0 +1,46 @@
|
||||
---
|
||||
title: Handle errors in advanced hunting for Microsoft Defender ATP
|
||||
description: Understand errors displayed when using advanced hunting
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp, m365, search, query, telemetry, schema, kusto, timeout, resources, errors, unknown error
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Handle advanced hunting errors
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
Advanced hunting displays errors to notify for syntax mistakes and whenever queries hit [predefined limits](advanced-hunting-limits.md). Refer to the table below for tips on how to resolve or avoid errors.
|
||||
|
||||
| Error type | Cause | Resolution | Error message examples |
|
||||
|--|--|--|--|
|
||||
| Syntax errors | The query contains unrecognized names, including references to nonexistent operators, columns, functions, or tables. | Ensure references to [Kusto operators and functions](https://docs.microsoft.com/azure/data-explorer/kusto/query/) are correct. Check [the schema](advanced-hunting-schema-reference.md) for the correct advanced hunting columns, functions, and tables. Enclose variable strings in quotes so they are recognized. While writing your queries, use the autocomplete suggestions from IntelliSense. | `A recognition error occurred.` |
|
||||
| Semantic errors | While the query uses valid operator, column, function, or table names, there are errors in its structure and resulting logic. In some cases, advanced hunting identifies the specific operator that caused the error. | Check for errors in the structure of query. Refer to [Kusto documentation](https://docs.microsoft.com/azure/data-explorer/kusto/query/) for guidance. While writing your queries, use the autocomplete suggestions from IntelliSense. | `'project' operator: Failed to resolve scalar expression named 'x'`|
|
||||
| Timeouts | A query can only run within a [limited period before timing out](advanced-hunting-limits.md). This error can happen more frequently when running complex queries. | [Optimize the query](advanced-hunting-best-practices.md) | `Query exceeded the timeout period.` |
|
||||
| CPU throttling | Queries in the same tenant have exceeded the [CPU resources](advanced-hunting-limits.md) that have been allocated based on tenant size. | The service checks CPU resource usage every 15 minutes and daily and displays warnings after usage exceeds 10% of the allocated limit. If you reach 100% utilization, the service blocks queries until after the next daily or 15-minute cycle. [Optimize your queries to avoid hitting CPU limits](advanced-hunting-best-practices.md) | - `This query used X% of your organization's allocated resources for the current 15 minutes.`<br>- `You have exceeded processing resources allocated to this tenant. You can run queries again in <duration>.` |
|
||||
| Result size limit exceeded | The aggregate size of the result set for the query has exceeded the maximum limit. This error can occur if the result set is so large that truncation at the 10,000-record limit can't reduce it to an acceptable size. Results that have multiple columns with sizable content are more likely to be impacted by this error. | [Optimize the query](advanced-hunting-best-practices.md) | `Result size limit exceeded. Use "summarize" to aggregate results, "project" to drop uninteresting columns, or "take" to truncate results.` |
|
||||
| Excessive resource consumption | The query has consumed excessive amounts of resources and has been stopped from completing. In some cases, advanced hunting identifies the specific operator that wasn't optimized. | [Optimize the query](advanced-hunting-best-practices.md) | -`Query stopped due to excessive resource consumption.`<br>-`Query stopped. Adjust use of the <operator name> operator to avoid excessive resource consumption.` |
|
||||
| Unknown errors | The query failed because of an unknown reason. | Try running the query again. Contact Microsoft through the portal if queries continue to return unknown errors. | `An unexpected error occurred during query execution. Please try again in a few minutes.`
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting best practices](advanced-hunting-best-practices.md)
|
||||
- [Service limits](advanced-hunting-limits.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Kusto Query Language overview](https://docs.microsoft.com/azure/data-explorer/kusto/query/)
|
||||
@ -0,0 +1,48 @@
|
||||
---
|
||||
title: Advanced hunting limits in Microsoft Defender ATP
|
||||
description: Understand various service limits that keep the advanced hunting service responsive
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp, search, query, telemetry, schema, kusto, CPU limit, query limit, resources, maximum results
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Advanced hunting service limits
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
To keep the service performant and responsive, advanced hunting sets various limits for queries run manually and by [custom detection rules](custom-detection-rules.md). Refer to the following table to understand these limits.
|
||||
|
||||
| Limit | Size | Refresh cycle | Description |
|
||||
|--|--|--|--|
|
||||
| Data range | 30 days | Every query | Each query can look up data from up to the past 30 days. |
|
||||
| Result set | 10,000 rows | Every query | Each query can return up to 10,000 records. |
|
||||
| Timeout | 10 minutes | Every query | Each query can run for up to 10 minutes. If it does not complete within 10 minutes, the service displays an error.
|
||||
| CPU resources | Based on tenant size | - On the hour and then every 15 minutes<br>- Daily at 12 midnight | The service enforces the daily and the 15-minute limit separately. For each limit, the [portal displays an error](advanced-hunting-errors.md) whenever a query runs and the tenant has consumed over 10% of allocated resources. Queries are blocked if the tenant has reached 100% until after the next daily or 15-minute cycle. |
|
||||
|
||||
>[!NOTE]
|
||||
>A separate set of limits apply to advanced hunting queries performed through the API. [Read about advanced hunting APIs](run-advanced-query-api.md)
|
||||
|
||||
Customers who run multiple queries regularly should track consumption and [apply optimization best practices](advanced-hunting-best-practices.md) to minimize disruption resulting from exceeding these limits.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting best practices](advanced-hunting-best-practices.md)
|
||||
- [Handle advanced hunting errors](advanced-hunting-errors.md)
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Custom detections rules](custom-detection-rules.md)
|
||||
@ -18,14 +18,20 @@ ms.topic: article
|
||||
---
|
||||
|
||||
# Proactively hunt for threats with advanced hunting
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
Advanced hunting is a query-based threat-hunting tool that lets you explore raw data for the last 30 days. You can proactively inspect events in your network to locate interesting indicators and entities. The flexible access to data facilitates unconstrained hunting for both known and potential threats.
|
||||
Advanced hunting is a query-based threat-hunting tool that lets you explore up to 30 days of raw data. You can proactively inspect events in your network to locate threat indicators and entities. The flexible access to data enables unconstrained hunting for both known and potential threats.
|
||||
|
||||
You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured devices.
|
||||
You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and then respond to suspected breach activity, misconfigured machines, and other findings.
|
||||
|
||||
>[!TIP]
|
||||
>Use [advanced hunting in Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/advanced-hunting-overview) to hunt for threats using data from Microsoft Defender ATP, Office 365 ATP, Microsoft Cloud App Security, and Azure ATP. [Turn on Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-enable)
|
||||
|
||||
## Get started with advanced hunting
|
||||
Watch this video for a quick overview of advanced hunting and a short tutorial that will get you started fast.
|
||||
@ -35,22 +41,25 @@ Watch this video for a quick overview of advanced hunting and a short tutorial t
|
||||
|
||||
You can also go through each of the following steps to ramp up your advanced hunting knowledge.
|
||||
|
||||
We recommend going through several steps to quickly get up and running with advanced hunting.
|
||||
|
||||
| Learning goal | Description | Resource |
|
||||
|--|--|--|
|
||||
| **Get a feel for the language** | Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/), supporting the same syntax and operators. Start learning the query language by running your first query. | [Query language overview](advanced-hunting-query-language.md) |
|
||||
| **Learn the language** | Advanced hunting is based on [Kusto query language](https://docs.microsoft.com/azure/kusto/query/), supporting the same syntax and operators. Start learning the query language by running your first query. | [Query language overview](advanced-hunting-query-language.md) |
|
||||
| **Learn how to use the query results** | Learn about charts and various ways you can view or export your results. Explore how you can quickly tweak queries and drill down to get richer information. | [Work with query results](advanced-hunting-query-results.md) |
|
||||
| **Understand the schema** | Get a good, high-level understanding of the tables in the schema and their columns. This will help you determine where to look for data and how to construct your queries. | [Schema reference](advanced-hunting-schema-reference.md) |
|
||||
| **Understand the schema** | Get a good, high-level understanding of the tables in the schema and their columns. Learn where to look for data when constructing your queries. | [Schema reference](advanced-hunting-schema-reference.md) |
|
||||
| **Use predefined queries** | Explore collections of predefined queries covering different threat hunting scenarios. | [Shared queries](advanced-hunting-shared-queries.md) |
|
||||
| **Learn about custom detections** | Understand how you can use advanced hunting queries to trigger alerts and apply response actions automatically. | - [Custom detections overview](overview-custom-detections.md)<br>- [Custom detection rules](custom-detection-rules.md) |
|
||||
| **Optimize queries and handle errors** | Understand how to create efficient and error-free queries. | - [Query best practices](advanced-hunting-best-practices.md)<br>- [Handle errors](advanced-hunting-errors.md) |
|
||||
| **Create custom detection rules** | Understand how you can use advanced hunting queries to trigger alerts and take response actions automatically. | - [Custom detections overview](overview-custom-detections.md)<br>- [Custom detection rules](custom-detection-rules.md) |
|
||||
|
||||
## Data freshness and update frequency
|
||||
Advanced hunting data can be categorized into two distinct types, each consolidated differently:
|
||||
Advanced hunting data can be categorized into two distinct types, each consolidated differently.
|
||||
|
||||
- **Event or activity data**—populates tables about alerts, security events, system events, and routine assessments. Advanced hunting receives this data almost immediately after the sensors that collect them successfully transmit them to Microsoft Defender ATP.
|
||||
- **Entity data**—populates tables with consolidated information about users and devices. To provide fresh data, tables are updated every 15 minutes with any new information, adding rows that might not be fully populated. Every 24 hours, data is consolidated to insert a record that contains the latest, most comprehensive data set about each entity.
|
||||
- **Entity data**—populates tables with consolidated information about users and devices. This data comes from both relatively static data sources and dynamic sources, such as Active Directory entries and event logs. To provide fresh data, tables are updated with any new information every 15 minutes, adding rows that might not be fully populated. Every 24 hours, data is consolidated to insert a record that contains the latest, most comprehensive data set about each entity.
|
||||
|
||||
## Time zone
|
||||
All time information in advanced hunting is currently in the UTC time zone.
|
||||
Time information in advanced hunting is currently in the UTC time zone.
|
||||
|
||||
## Related topics
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
@ -58,4 +67,4 @@ All time information in advanced hunting is currently in the UTC time zone.
|
||||
- [Use shared queries](advanced-hunting-shared-queries.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Apply query best practices](advanced-hunting-best-practices.md)
|
||||
- [Custom detections overview](overview-custom-detections.md)
|
||||
- [Custom detections overview](overview-custom-detections.md)
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# Learn the advanced hunting query language
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# Work with advanced hunting query results
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -137,4 +140,4 @@ Once you apply the filter to modify the query and then run the query, the result
|
||||
- [Use shared queries](advanced-hunting-shared-queries.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Apply query best practices](advanced-hunting-best-practices.md)
|
||||
- [Custom detections overview](overview-custom-detections.md)
|
||||
- [Custom detections overview](overview-custom-detections.md)
|
||||
|
||||
@ -20,6 +20,9 @@ ms.date: 01/14/2020
|
||||
|
||||
# Understand the advanced hunting schema
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: article
|
||||
|
||||
# Use shared queries in advanced hunting
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -63,4 +66,4 @@ Microsoft security researchers regularly share advanced hunting queries in a [de
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
|
||||
@ -20,6 +20,9 @@ ms.date: 09/03/2018
|
||||
---
|
||||
|
||||
# Alerts queue in Microsoft Defender Security Center
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
Learn how you can view and manage the queue so that you can effectively investigate threats seen on entities such as devices, files, or user accounts.
|
||||
|
||||
|
||||
|
||||
@ -20,6 +20,9 @@ ms.date: 03/27/2020
|
||||
|
||||
# View and organize the Microsoft Defender Advanced Threat Protection Alerts queue
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -18,6 +18,9 @@ ms.topic: article
|
||||
|
||||
# Alert resource type
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
@ -19,6 +19,9 @@ ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Configure Microsoft Defender ATP for Android features
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Android](microsoft-defender-atp-android.md)
|
||||
|
||||
@ -20,6 +20,9 @@ ms.topic: conceptual
|
||||
|
||||
# Deploy Microsoft Defender ATP for Android with Microsoft Intune
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Android](microsoft-defender-atp-android.md)
|
||||
@ -30,7 +33,7 @@ device](https://docs.microsoft.com/mem/intune/user-help/enroll-device-android-co
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> **Microsoft Defender ATP for Android is now available on [Google Play](https://play.google.com/store/apps/details?id=com.microsoft.scmx) now.** <br>
|
||||
> **Microsoft Defender ATP for Android is now available on [Google Play](https://play.google.com/store/apps/details?id=com.microsoft.scmx)** <br>
|
||||
> You can connect to Google Play from Intune to deploy Microsoft Defender ATP app across Device Administrator and Android Enterprise entrollment modes.
|
||||
Updates to the app are automatic via Google Play.
|
||||
|
||||
@ -55,7 +58,7 @@ center](https://go.microsoft.com/fwlink/?linkid=2109431) , go to **Apps** \>
|
||||
- **Name**
|
||||
- **Description**
|
||||
- **Publisher** as Microsoft.
|
||||
- **Appstore URL** as https://play.google.com/store/apps/details?id=com.microsoft.scmx (Microsoft Defender ATP Preview app Google Play Store URL)
|
||||
- **Appstore URL** as https://play.google.com/store/apps/details?id=com.microsoft.scmx (Microsoft Defender ATP app Google Play Store URL)
|
||||
|
||||
Other fields are optional. Select **Next**.
|
||||
|
||||
@ -70,14 +73,14 @@ center](https://go.microsoft.com/fwlink/?linkid=2109431) , go to **Apps** \>
|
||||
> 
|
||||
|
||||
|
||||
6. In the **Review+Create** section, verify that all the information entered is correct and then select **Create**.
|
||||
4. In the **Review+Create** section, verify that all the information entered is correct and then select **Create**.
|
||||
|
||||
In a few moments, the Microsoft Defender ATP app would be created successfully, and a notification would show up at the top-right corner of the page.
|
||||
|
||||
|
||||
|
||||
|
||||
7. In the app information page that is displayed, in the **Monitor** section,
|
||||
5. In the app information page that is displayed, in the **Monitor** section,
|
||||
select **Device install status** to verify that the device installation has
|
||||
completed successfully.
|
||||
|
||||
|
||||
@ -0,0 +1,111 @@
|
||||
---
|
||||
title: Microsoft Defender ATP for Android - Privacy information
|
||||
description: Privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Android.
|
||||
keywords: microsoft, defender, atp, android, privacy, diagnostic
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Microsoft Defender ATP for Android - Privacy information
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Android](microsoft-defender-atp-android.md)
|
||||
|
||||
|
||||
Microsoft Defender ATP for Android collects information from your configured
|
||||
Android devices and stores it in the same tenant where you have Microsoft
|
||||
Defender ATP.
|
||||
|
||||
Information is collected to help keep Microsoft Defender ATP for Android secure,
|
||||
up-to-date, performing as expected and to support the service.
|
||||
|
||||
## Required Data
|
||||
|
||||
Required data consists of data that is necessary to make Microsoft Defender ATP
|
||||
for Android work as expected. This data is essential to the operation of the
|
||||
service and can include data related to the end user, organization, device, and
|
||||
apps. Here's a list of the types of data being collected:
|
||||
|
||||
### App information
|
||||
|
||||
Information about Android application packages (APKs) on the device including
|
||||
|
||||
- Install source
|
||||
- Storage location (file path) of the APK
|
||||
- Time of install, size of APK and permissions
|
||||
|
||||
### Web page / Network information
|
||||
|
||||
- Full URL (on supported browsers), when clicked
|
||||
- Connection information
|
||||
- Protocol type (such as HTTP, HTTPS, etc.)
|
||||
|
||||
|
||||
### Device and account information
|
||||
|
||||
- Device information such as date & time, Android version, OEM model, CPU
|
||||
info, and Device identifier
|
||||
- Device identifier is one of the below:
|
||||
- Wi-Fi adapter MAC address
|
||||
- [Android
|
||||
ID](https://developer.android.com/reference/android/provider/Settings.Secure#ANDROID_ID)
|
||||
(as generated by Android at the time of first boot of the device)
|
||||
- Randomly generated globally unique identifier (GUID)
|
||||
|
||||
- Tenant, Device and User information
|
||||
- Azure Active Directory (AD) Device ID and Azure User ID: Uniquely
|
||||
identifies the device, User respectively at Azure Active directory.
|
||||
|
||||
- Azure tenant ID - GUID that identifies your organization within
|
||||
Azure Active Directory
|
||||
|
||||
- Microsoft Defender ATP org ID - Unique identifier associated with
|
||||
the enterprise that the device belongs to. Allows Microsoft to
|
||||
identify whether issues are impacting a select set of enterprises
|
||||
and how many enterprises are impacted
|
||||
|
||||
- User Principal Name – Email ID of the user
|
||||
|
||||
### Product and service usage data
|
||||
- App package info, including name, version, and app upgrade status
|
||||
|
||||
- Actions performed in the app
|
||||
|
||||
- Threat detection information, such as threat name, category, etc.
|
||||
|
||||
- Crash report logs generated by Android
|
||||
|
||||
## Optional Data
|
||||
|
||||
Optional data includes diagnostic data and feedback data. Optional diagnostic
|
||||
data is additional data that helps us make product improvements and provides
|
||||
enhanced information to help us detect, diagnose, and fix issues. Optional
|
||||
diagnostic data includes:
|
||||
|
||||
- App, CPU, and network usage
|
||||
|
||||
- State of the device from the app perspective, including scan status, scan
|
||||
timings, app permissions granted, and upgrade status
|
||||
|
||||
- Features configured by the admin
|
||||
|
||||
- Basic information about the browsers on the device
|
||||
|
||||
**Feedback Data** is collected through in-app feedback provided by the user
|
||||
|
||||
- The user’s email address, if they choose to provide it
|
||||
|
||||
- Feedback type (smile, frown, idea) and any feedback comments submitted by
|
||||
the user
|
||||
@ -0,0 +1,98 @@
|
||||
---
|
||||
title: Troubleshoot issues on Microsoft Defender ATP for Android
|
||||
ms.reviewer:
|
||||
description: Troubleshoot issues for Microsoft Defender ATP for Android
|
||||
keywords: microsoft, defender, atp, android, cloud, connectivity, communication
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Troubleshooting issues on Microsoft Defender ATP for Android
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for
|
||||
Android](microsoft-defender-atp-android.md)
|
||||
|
||||
During onboarding, you might encounter sign in issues after the app is installed on your device.
|
||||
|
||||
This article provides solutions to address the sign on issues.
|
||||
|
||||
## Sign in failed - unexpected error
|
||||
**Sign in failed:** *Unexpected error, try later*
|
||||
|
||||
|
||||
|
||||
**Message:**
|
||||
|
||||
Unexpected error, try later
|
||||
|
||||
**Cause:**
|
||||
|
||||
You have an older version of "Microsoft Authenticator" app installed on your
|
||||
device.
|
||||
|
||||
**Solution:**
|
||||
|
||||
Install latest version and of [Microsoft
|
||||
Authenticator](https://play.google.com/store/apps/details?androidid=com.azure.authenticator)
|
||||
from Google Play Store and try again
|
||||
|
||||
## Sign in failed - invalid license
|
||||
|
||||
**Sign in failed:** *Invalid license, please contact administrator*
|
||||
|
||||
|
||||
|
||||
**Message:** *Invalid license, please contact administrator*
|
||||
|
||||
**Cause:**
|
||||
|
||||
You do not have Microsoft 365 license assigned, or your organization does not
|
||||
have a license for Microsoft 365 Enterprise subscription.
|
||||
|
||||
**Solution:**
|
||||
|
||||
Contact your administrator for help.
|
||||
|
||||
## Phishing pages are not blocked on specific OEM devices
|
||||
|
||||
**Applies to:** Specific OEMs only
|
||||
|
||||
- **Xiaomi**
|
||||
|
||||
Phishing and harmful web connection threats detected by Microsoft Defender ATP
|
||||
for Android are not blocked on some Xiaomi devices. The following functionality does not work on these devices.
|
||||
|
||||
|
||||
|
||||
|
||||
**Cause:**
|
||||
|
||||
Xiaomi devices introduced a new permission that prevents Microsoft Defender ATP
|
||||
for Android app from displaying pop-up windows while running in the background.
|
||||
|
||||
Xiaomi devices permission: "Display pop-up windows while running in the
|
||||
background."
|
||||
|
||||
|
||||
|
||||
**Solution:**
|
||||
|
||||
Enable the required permission on Xiaomi devices.
|
||||
|
||||
- Display pop-up windows while running in the background.
|
||||
@ -20,6 +20,9 @@ hideEdit: true
|
||||
---
|
||||
|
||||
# Microsoft Defender ATP for Android application license terms
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Android](microsoft-defender-atp-android.md)
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user