You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-vulnerability-management/tvm-block-vuln-apps.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,18 +26,18 @@ ms.date: 12/05/2024
26
26
27
27
Remediating vulnerabilities takes time and can be dependent on the responsibilities and resources of the IT team. Security administrators can temporarily reduce the risk of a vulnerability by taking immediate action to block all currently known vulnerable versions of an application until the remediation request is completed. The block option gives your IT teams time to patch an application without worrying your security administrators that the vulnerabilities will be exploited.
28
28
29
-
While taking the remediation steps suggested by a security recommendation, security administartors can perform a mitigation action and block vulnerable versions of an application. File indicators of compromise (IOC)s are created for each of the executable files that belong to vulnerable versions of that application. Microsoft Defender Antivirus then enforces blocks on the devices that are in the specified scope.
29
+
While taking the remediation steps suggested by a security recommendation, security administrators can perform a mitigation action and block vulnerable versions of an application. File indicators of compromise (IOC)s are created for each of the executable files that belong to vulnerable versions of that application. Microsoft Defender Antivirus then enforces blocks on the devices that are in the specified scope.
30
30
31
31
## Block or warn mitigation action
32
32
33
33
The **block action** is intended to block all installed vulnerable versions of the application in your organization from running. For example, if there's an active zero-day vulnerability you can block your users from running the affected software while you determine work-around options.
34
34
35
35
The **warn action** is intended to send a warning to your users when they open vulnerable versions of the application. Users can choose to bypass the warning and access the application for subsequent launches.
36
36
37
-
For both actions, you can customize the message the users see. For example, you can encourage them to install the latest version. Additionally, you can provide a custom URL the users navigate to when they select the notification. The user must select the body of the toast notification in order to navigate to the custom URL. This can be used to provide additional details specific to the application management in your organization.
37
+
For both actions, you can customize the message the users see. For example, you can encourage them to install the latest version. Additionally, you can provide a custom URL the users navigate to when they select the notification. The user must select the body of the toast notification in order to navigate to the custom URL. The notification can be used to provide additional details specific to the application management in your organization.
38
38
39
39
> [!NOTE]
40
-
> The block and warn actions are typically enforced within a couple of minutes but can take up to 3 hours.
40
+
> The block and warn actions are typically enforced within a few minutes but can take up to three hours.
41
41
42
42
## Minimum requirements
43
43
@@ -47,10 +47,10 @@ For both actions, you can customize the message the users see. For example, you
47
47
48
48
## Version requirements
49
49
50
-
- The Antimalware client version must be 4.18.1901.x or later.
51
-
- The Engine version must be 1.1.16200.x or later.
52
-
-Supported on Windows 10 devices, version 1809 or later, with the latest windows updates installed.
53
-
-Supports Windows Server versions 2022, 2019, 2016, 2012 R2, and 2008 R2 SP1.
50
+
- The Antimalware client version must be `4.18.1901.x` or later.
51
+
- The Engine version must be `1.1.16200.x` or later.
52
+
-Windows client devices must be running Windows 11 or Windows 10, version 1809 or later, with the latest windows updates installed.
53
+
-Servers must be running Windows Server 2022, 2019, 2016, 2012 R2, and 2008 R2 SP1. Support for Windows Server 2025 is rolling out, beginning in February 2025 and over the next several weeks.
0 commit comments