You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/aggregated-reporting.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ ms.collection:
12
12
- tier3
13
13
ms.topic: conceptual
14
14
search.appverid: met150
15
-
ms.date: 01/21/2025
15
+
ms.date: 03/04/2025
16
16
appliesto:
17
17
- Microsoft Defender for Endpoint Plan 2
18
18
---
@@ -38,8 +38,8 @@ The following requirements must be met before turning on aggregated reporting:
38
38
39
39
Aggregated reporting supports the following:
40
40
41
-
- Client version: Windows version 2411 and above
42
-
- Operating systems: Windows 11 22H2, Windows Server 2022, Windows 11 Enterprise, Windows 10 20H2, 21H1, 21H2, Windows Server version 20H2, and Windows Server 2019
41
+
- Client version: Windows version 2411 and later
42
+
- Operating systems: Windows 11 22H2, Windows 11 Enterprise, Windows 10 20H2, 21H1, 21H2, Windows Server 2025, Windows Server 2022, Windows Server 2019, or Windows Server version 20H2
Copy file name to clipboardExpand all lines: defender-endpoint/attack-surface-reduction.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -144,7 +144,7 @@ You can set attack surface reduction rules for devices that are running any of t
144
144
> [!NOTE]
145
145
> Windows Server 2016 and Windows Server 2012 R2 must be onboarded using the instructions in [Onboard Windows servers](/defender-endpoint/configure-server-endpoints#functionality-in-the-modern-unified-solution) for this feature to work.
146
146
147
-
Although attack surface reduction rules don't require a [Windows E5 license](/windows/deployment/deploy-enterprise-licenses), if you have Windows E5, you get advanced management capabilities. The advanced capabilities - available only in Windows E5 - include:
147
+
Although attack surface reduction rules don't require a [Windows E5 license](/windows/deployment/deploy-enterprise-licenses), if you have Windows E5, you get advanced management capabilities. The advanced capabilities - available only in Windows E5 - include:S
148
148
149
149
- The monitoring, analytics, and workflows available in [Defender for Endpoint](microsoft-defender-endpoint.md)
150
150
- The reporting and configuration capabilities in [Microsoft Defender XDR](/defender-xdr/microsoft-365-defender).
Copy file name to clipboardExpand all lines: defender-endpoint/configure-server-exclusions-microsoft-defender-antivirus.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ description: Windows Server includes automatic exclusions, based on server role.
6
6
ms.service: defender-endpoint
7
7
ms.subservice: ngp
8
8
ms.localizationpriority: medium
9
-
ms.date: 02/04/2025
9
+
ms.date: 03/04/2025
10
10
author: emmwalshh
11
11
ms.author: ewalsh
12
12
ms.topic: conceptual
@@ -327,7 +327,7 @@ The list of built-in exclusions in Windows is kept up to date as the threat land
327
327
In Windows Server 2016 and later, the predefined exclusions delivered by [Security intelligence updates](microsoft-defender-antivirus-updates.md#security-intelligence-updates) only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, make sure to opt out of the automatic exclusions delivered in Security intelligence updates. But keep in mind that the exclusions that are delivered automatically are optimized for Windows Server 2016 and later. See [Important points about exclusions](configure-exclusions-microsoft-defender-antivirus.md#important-points-about-exclusions) before defining your exclusion lists.
328
328
329
329
> [!WARNING]
330
-
> Opting out of automatic exclusions might adversely impact performance, or result in data corruption. Automatic server role exclusions are optimized for Windows Server 2016, Windows Server 2019, and Windows Server 2022 and later.
330
+
> Opting out of automatic exclusions might adversely impact performance, or result in data corruption. Automatic server role exclusions are optimized for Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025.
331
331
332
332
333
333
Because predefined exclusions only exclude **default paths**, if you move NTDS and SYSVOL folders to another drive or path that is *different from the original path*, you must add exclusions manually. See [Configure the list of exclusions based on folder name or file extension](configure-extension-file-exclusions-microsoft-defender-antivirus.md#configure-the-list-of-exclusions-based-on-folder-name-or-file-extension).
Copy file name to clipboardExpand all lines: defender-endpoint/controlled-folders.md
+20-13Lines changed: 20 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,9 @@
1
1
---
2
2
title: Protect important folders from ransomware from encrypting your files with controlled folder access
3
-
description: Files in default folders can be protected from being changed by malicious apps. Prevent ransomware from encrypting your files.
3
+
description: Files in default folders can be protected from changes through malicious apps. Prevent ransomware from encrypting your files.
4
4
ms.service: defender-endpoint
5
5
ms.localizationpriority: medium
6
-
ms.date: 11/19/2024
6
+
ms.date: 03/04/2025
7
7
author: denisebmsft
8
8
ms.author: deniseb
9
9
audience: ITPro
@@ -37,10 +37,17 @@ search.appverid: met150
37
37
38
38
## What is controlled folder access?
39
39
40
-
Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Controlled folder access can be configured by using the Windows Security App, Microsoft Endpoint Configuration Manager, or Intune (for managed devices). Controlled folder access is supported on Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, and Windows 11,
40
+
Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Controlled folder access can be configured by using the Windows Security App, Microsoft Endpoint Configuration Manager, or Intune (for managed devices). Controlled folder access is supported on:
41
+
- Windows 11
42
+
- Windows 10
43
+
- Windows Server 2025
44
+
- Windows Server 2022
45
+
- Windows Server 2019
46
+
- Windows Server 2016
47
+
- Windows Server 2012 R2
41
48
42
49
> [!NOTE]
43
-
> Scripting engines like PowerShell are not trusted by controlled folder access, even if you create an "allow" indicator by using [certificate and file indicators](indicator-certificates.md). The only way to allow script engines to modify protected folders is by adding them as an allowed app. See [Allow specific apps to make changes to controlled folders](/defender-endpoint/customize-controlled-folders).
50
+
> Scripting engines like PowerShell aren't trusted by controlled folder access, even if you create an "allow" indicator by using [certificate and file indicators](indicator-certificates.md). The only way to allow script engines to modify protected folders is by adding them as an allowed app. See [Allow specific apps to make changes to controlled folders](/defender-endpoint/customize-controlled-folders).
44
51
45
52
Controlled folder access works best with [Microsoft Defender for Endpoint](microsoft-defender-endpoint.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](investigate-alerts.md).
46
53
@@ -51,11 +58,11 @@ Controlled folder access works best with [Microsoft Defender for Endpoint](micro
51
58
52
59
Controlled folder access works by only allowing trusted apps to access protected folders. Protected folders are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, and so on, are included in the list of controlled folders.
53
60
54
-
Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the list are prevented from making any changes to files inside protected folders.
61
+
Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that aren't included in the list are prevented from making any changes to files inside protected folders.
55
62
56
-
Apps are added to the list based upon their prevalence and reputation. Apps that are highly prevalent throughout your organization and that have never displayed any behavior deemed malicious are considered trustworthy. Those apps are added to the list automatically.
63
+
Apps are added to the list based upon their prevalence and reputation. Apps that are highly prevalent throughout your organization and that haven't ever displayed any behavior deemed malicious are considered trustworthy. Those apps are added to the list automatically.
57
64
58
-
Apps can also be added manually to the trusted list by using Configuration Manager or Intune. Additional actions can be performed from the Microsoft Defender portal.
65
+
Apps can also be added manually to the trusted list by using Configuration Manager or Intune. Other actions can be performed in the Microsoft Defender portal.
59
66
60
67
## Why controlled folder access is important
61
68
@@ -69,7 +76,7 @@ You can use [audit mode](overview-attack-surface-reduction.md) to evaluate how c
69
76
70
77
Windows system folders are protected by default, along with several other folders:
71
78
72
-
The protected folders include common system folders (including boot sectors), and you can add additional folders. You can also allow apps to give them access to the protected folders. The Windows systems folders that are protected by default are:
79
+
The protected folders include common system folders (including boot sectors), and you can add other folders. You can also allow apps to give them access to the protected folders. The Windows systems folders that are protected by default are:
73
80
74
81
-`c:\Users\<username>\Documents`
75
82
-`c:\Users\Public\Documents`
@@ -86,7 +93,7 @@ Default folders appear in the user's profile, under **This PC**, as shown in the
86
93
87
94
88
95
> [!NOTE]
89
-
> You can configure additional folders as protected, but you cannot remove the Windows system folders that are protected by default.
96
+
> You can configure more folders as protected, but you can't remove the Windows system folders that are protected by default.
## Review controlled folder access events in the Microsoft Defender portal
98
105
99
-
Defender for Endpoint provides detailed reporting into events and blocks as part of its [alert investigation scenarios](investigate-alerts.md) in the Microsoft Defender portal; see [Microsoft Defender for Endpoint in Microsoft Defender XDR](/defender-xdr/microsoft-365-security-center-mde).
106
+
Defender for Endpoint provides detailed reporting into events and blocks as part of its [alert investigation scenarios](investigate-alerts.md) in the Microsoft Defender portal. For more information, see [Microsoft Defender for Endpoint in Microsoft Defender XDR](/defender-xdr/microsoft-365-security-center-mde).
100
107
101
108
You can query Microsoft Defender for Endpoint data by using [Advanced hunting](/defender-xdr/advanced-hunting-overview). If you're using [audit mode](overview-attack-surface-reduction.md), you can use [advanced hunting](/defender-xdr/advanced-hunting-overview) to see how controlled folder access settings would affect your environment if they were enabled.
102
109
@@ -141,16 +148,16 @@ You can use the Windows Security app to view the list of folders that are protec
141
148
142
149
3. Under **Ransomware protection**, select **Manage ransomware protection**.
143
150
144
-
4. If controlled folder access is turned off, you'll need to turn it on. Select **protected folders**.
151
+
4. If controlled folder access is turned off, you need to turn it on. Select **protected folders**.
145
152
146
153
5. Do one of the following steps:
147
154
148
155
- To add a folder, select **+ Add a protected folder**.
149
156
- To remove a folder, select it, and then select **Remove**.
150
157
151
158
> [!IMPORTANT]
152
-
> Do not add local share paths (loopbacks) as protected folders. Use the local path instead. For example, if you have shared `C:\demo` as `\\mycomputer\demo`, do not add `\\mycomputer\demo` to the list of protected folders. Instead add `C:\demo`.
159
+
> Don't add local share paths (loopbacks) as protected folders. Use the local path instead. For example, if you have shared `C:\demo` as `\\mycomputer\demo`, don't add `\\mycomputer\demo` to the list of protected folders. Instead add `C:\demo`.
153
160
154
-
[Windows system folders](#windows-system-folders-are-protected-by-default) are protected by default, and you cannot remove them from the list. Subfolders are also included in protection when you add a new folder to the list.
161
+
[Windows system folders](#windows-system-folders-are-protected-by-default) are protected by default, and you can't remove them from the list. Subfolders are also included in protection when you add a new folder to the list.
155
162
156
163
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
Copy file name to clipboardExpand all lines: defender-endpoint/customize-controlled-folders.md
+8-2Lines changed: 8 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.collection:
15
15
- tier2
16
16
- mde-asr
17
17
search.appverid: met150
18
-
ms.date: 10/17/2024
18
+
ms.date: 03/04/2025
19
19
---
20
20
21
21
# Customize controlled folder access
@@ -33,7 +33,13 @@ ms.date: 10/17/2024
33
33
> [!TIP]
34
34
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://go.microsoft.com/fwlink/p/?linkid=2225630)
35
35
36
-
Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is supported on Windows Server 2019, Windows Server 2022, Windows 10, and Windows 11 clients.
36
+
Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is supported on:
37
+
38
+
- Windows 11
39
+
- Windows 10
40
+
- Windows Server 2025
41
+
- Windows Server 2022
42
+
- Windows Server 2019
37
43
38
44
> [!IMPORTANT]
39
45
> Controlled folder access is not supported on Linux servers.
Copy file name to clipboardExpand all lines: defender-endpoint/defender-endpoint-demonstration-attack-surface-reduction-rules.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@ ms.collection:
14
14
- demo
15
15
ms.topic: article
16
16
ms.subservice: asr
17
-
ms.date: 01/15/2024
17
+
ms.date: 03/04/2025
18
18
---
19
19
20
20
# Attack surface reduction rules demonstrations
@@ -34,8 +34,8 @@ Attack surface reduction rules target specific behaviors that are typically used
34
34
35
35
## Scenario requirements and setup
36
36
37
-
- Windows 11, Windows 10 1709 build 16273 or later
38
-
- Windows Server 2022, Windows Server 2019, Windows Server 2016, or Windows Server 2012 R2 with the unified MDE client.
37
+
- Windows client devices must be running Windows 11, Windows 10 1709 build 16273, or later
38
+
- Windows server devices must be running Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows Server 2016, or Windows Server 2012 R2 (with the unified MDE client).
39
39
- Microsoft Defender Antivirus
40
40
- Microsoft 365 Apps (Office; required for Office rules and sample)
0 commit comments