Skip to content

Commit b9814b3

Browse files
padmagit77padmagit77
authored
Merge pull request #2467 from MicrosoftDocs/main
Published main to live, Thursday 10:30 AM PST, 01/16
2 parents 2d3e117 + 21042c7 commit b9814b3

File tree

4 files changed

+30
-14
lines changed

4 files changed

+30
-14
lines changed

‎ATPDocs/health-alerts.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Microsoft Defender for Identity health issues
33
description: This article describes all the health issues that can occur for each component, listing the cause and the steps needed to resolve the problem
4-
ms.date: 07/09/2024
4+
ms.date: 01/16/2025
55
ms.topic: how-to
66
---
77

@@ -191,6 +191,12 @@ Sensor-specific health issues are displayed in the **Sensor health issues** tab
191191
|----|----|----|----|----|
192192
|Radius accounting (VPN integration) data ingestion failures.|The listed Defender for Identity sensors have radius accounting (VPN integration) data ingestion failures.|Validate that the shared secret in the Defender for Identity configuration settings matches your VPN server, according to the guidance described [Configure VPN in Defender for Identity](vpn-integration.md#configure-vpn-in-defender-for-identity) section, in the [Defender for Identity VPN integration](vpn-integration.md) page.|Low|Health issues page|
193193

194+
### Auditing for AD CS servers is not enabled as required
195+
196+
|Alert|Description|Resolution|Severity|Displayed in|
197+
|----|----|----|----|----|
198+
|Auditing for AD CS servers is not enabled as required. (This configuration is validated once a day, per sensor).|The Advanced Auditing Policy Configuration or AD CS auditing is not enabled as required.|Enable the Advanced Auditing Policy Configuration and AD CS auditing according to the guidance as described in the [Configure auditing on AD CS](configure-windows-event-collection.md#configure-auditing-on-ad-cs) section, in the [Configure Windows Event collection](configure-windows-event-collection.md) page.|Medium|Sensors health issues tab|
199+
194200
### Sensor failed to retrieve Microsoft Entra Connect service configuration
195201

196202
| Alert| Description |Resolution|Severity|Displayed in|

‎defender-endpoint/command-line-arguments-microsoft-defender-antivirus.md‎

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.author: ewalsh
88
ms.custom: nextgen
99
ms.reviewer: ksarens
1010
manager: deniseb
11-
ms.date: 01/15/2025
11+
ms.date: 01/16/2025
1212
ms.subservice: ngp
1313
ms.topic: how-to
1414
ms.collection:
@@ -32,7 +32,7 @@ search.appverid: met150
3232
You can perform various functions in Microsoft Defender Antivirus using the dedicated command-line tool **mpcmdrun.exe**. This utility is useful when you want to automate Microsoft Defender Antivirus tasks. You can find the utility in `%ProgramFiles%\Windows Defender\MpCmdRun.exe`. Run it from a command prompt.
3333

3434
> [!TIP]
35-
> You might need to open an administrator-level version of the command prompt. When you search for **Command Prompt** on the Start menu, choose **Run as administrator**. If you're running an updated Microsoft Defender antimalware platform version, run `MpCmdRun` from the following location: `C:\ProgramData\Microsoft\Windows Defender\Platform\<antimalware platform version>`. For more information about the antimalware platform, see [Microsoft Defender Antivirus updates and baselines](microsoft-defender-antivirus-updates.md).
35+
> You might need to open an administrator-level version of the command prompt. When you search for **Command Prompt** on the **Start** menu, choose **Run as administrator**. If you're running an updated Microsoft Defender antimalware platform version, run `MpCmdRun` from the following location: `C:\ProgramData\Microsoft\Windows Defender\Platform\<antimalware platform version>`. For more information about the antimalware platform, see [Microsoft Defender Antivirus updates and baselines](microsoft-defender-antivirus-updates.md).
3636
3737
The MpCmdRun utility uses the following syntax:
3838

@@ -52,29 +52,36 @@ In our example, the MpCmdRun utility starts a full antivirus scan on the device.
5252

5353
|Command|Description|
5454
|---|---|
55-
|`-?` **or** `-h`|Displays all available options for the MpCmdRun tool|
55+
|`-?` **or** `-h`|Displays all available options for the MpCmdRun tool.|
5656
|`-Scan [-ScanType [<value>]] [-File <path> [-DisableRemediation] [-BootSectorScan] [-CpuThrottling]] [-Timeout <days>] [-Cancel]`|Scans for malicious software. Values for **ScanType** are:<p>**0** Default, according to your configuration<p>**1** Quick scan<p>**2** Full scan<p>**3** File and directory custom scan.<p>CpuThrottling runs according to policy configurations.|
57-
|`-Trace [-Grouping #] [-Level #]`|Starts diagnostic tracing|
57+
|`-Trace [-Grouping #] [-Level #]`|Starts diagnostic tracing.|
5858
|`-CaptureNetworkTrace -Path <path>`|Captures all the network input into the Network Protection service and saves it to a file at `<path>`. <br/>Supply an empty path to stop tracing.|
5959
|`-GetFiles [-SupportLogLocation <path>]`|Collects support information. See [collecting diagnostic data](collect-diagnostic-data.md).|
6060
|`-GetFilesDiagTrack`|Same as `-GetFiles`, but outputs to temporary DiagTrack folder.|
6161
|`-RemoveDefinitions [-All]`|Restores the installed security intelligence to a previous backup copy or to the original default set.|
6262
|`-RemoveDefinitions [-DynamicSignatures]`|Removes only the dynamically downloaded security intelligence.|
6363
|`-RemoveDefinitions [-Engine]`|Restores the previous installed engine.|
64-
|`-SignatureUpdate [-UNC \|-MMPC]`|Checks for new security intelligence updates.|
65-
|`-Restore [-ListAll \|[[-Name <name>] [-All] \|[-FilePath <filePath>]] [-Path <path>]]`|Restores or lists quarantined item(s).|
64+
|`-SignatureUpdate [-UNC |-MMPC]`|Checks for new security intelligence updates.|
65+
|`-Restore [-ListAll |[[-Name <name>] [-All] |[-FilePath <filePath>]] [-Path <path>]]`|Restores or lists quarantined items.|
6666
|`-AddDynamicSignature [-Path]`|Loads dynamic security intelligence.|
6767
|`-ListAllDynamicSignatures`|Lists the loaded dynamic security intelligence.|
6868
|`-RemoveDynamicSignature [-SignatureSetID]`|Removes dynamic security intelligence.|
6969
|`-CheckExclusion -path <path>`|Checks whether a path is excluded.|
70+
|`-TDT [-on|-off|-default]`|Disable or Enable TDT feature or sets it to default. If no option is specified, it retrieves the current status.|
71+
|`-OSCA`|Prints OS Copy Acceleration feature status.|
72+
|`-DeviceControl -TestPolicyXml <FilePath> [-Rules | -Groups]`|Validate xml policy groups and rules.|
73+
|`-TrustCheck -File <FilePath>`|Checks trust status of a file.|
7074
|`-ValidateMapsConnection`|Verifies that your network can communicate with the Microsoft Defender Antivirus cloud service. This command will only work on Windows 10, version 1703 or higher.|
75+
|`-ListCustomASR`|List the custom Azure Site Recovery rules present on this device.|
76+
|`-DisplayECSConnection`|Displays URLs that Defender Core service uses to establish connection to ECS.|
77+
|`-HeapSnapshotConfig <-Enable|-Disable> [-Pid <ProcessID>]`|Enable or Disable heap snapshot (tracing) configuration for process. Replace `<ProcessID>` with the actual process ID.|
7178
|`-ResetPlatform`| Reset platform binaries back to `%ProgramFiles%\Windows Defender`.|
7279
|`-RevertPlatform`| Revert platform binaries back to the previously installed version of the Defender platform.|
7380

7481
> [!NOTE]
75-
> For the "Scan" command, the following are the default timeout values for Quick or Full scans where the scan will stop at that time by default.
76-
- Scheduled Full Scans or MpCmdRun -scan: 7 day limit
77-
- Scheduled Quick Scans or MpCmdRun -scan: 1 day limit
82+
> For the `Scan` command, the following are the default time out values for Quick or Full scans where the scan will stop at that time by default.
83+
> - Scheduled Full Scans or MpCmdRun -scan: Seven day limit
84+
> - Scheduled Quick Scans or MpCmdRun -scan: One day limit
7885
7986

8087
## Common errors in running commands via mpcmdrun.exe
@@ -83,7 +90,7 @@ The following table lists common errors that can occur while using the MpCmdRun
8390

8491
|Error message|Possible reason|
8592
|---|---|
86-
|**ValidateMapsConnection failed (800106BA)** or **0x800106BA**|The Microsoft Defender Antivirus service is disabled. Enable the service and try again. If you need help re-enabling Microsoft Defender Antivirus, see [Reinstall/enable Microsoft Defender Antivirus on your endpoints](switch-to-mde-phase-2.md#step-1-reinstallenable-microsoft-defender-antivirus-on-your-endpoints).<p> Note that in Windows 10 1909 or older, and Windows Server 2019 or older, the service was formerly called *Windows Defender Antivirus*.|
93+
|**ValidateMapsConnection failed (800106BA)** or **0x800106BA**|The Microsoft Defender Antivirus service is disabled. Enable the service and try again. If you need help re-enabling Microsoft Defender Antivirus, see [Reinstall/enable Microsoft Defender Antivirus on your endpoints](switch-to-mde-phase-2.md#step-1-reinstallenable-microsoft-defender-antivirus-on-your-endpoints).<p> In Windows 10 1909 or older, and Windows Server 2019 or older, the service was formerly called *Windows Defender Antivirus*.|
8794
|**0x80070667**|You're running the `-ValidateMapsConnection` command from a computer that is Windows 10 version 1607 or older, or Windows Server 2016 or older. Run the command from a machine that is Windows 10 version 1703 or newer, or Windows Server 2019 or newer.|
8895
|**MpCmdRun is not recognized as an internal or external command, operable program, or batch file.**|The tool must be run from either `%ProgramFiles%\Windows Defender` or `C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2012.4-0` (where `2012.4-0` might differ since platform updates are monthly except for March)|
8996
|**ValidateMapsConnection failed to establish a connection to MAPS (hr=80070005 httpcode=450)**|The command was attempted using insufficient privileges. Use the command prompt (cmd.exe) as an administrator.|
@@ -98,7 +105,7 @@ The following table lists common errors that can occur while using the MpCmdRun
98105
- [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md)
99106
- [Configure Microsoft Defender Antivirus features](configure-microsoft-defender-antivirus-features.md)
100107
- [Configure and validate Microsoft Defender Antivirus network connections](configure-network-connections-microsoft-defender-antivirus.md)
101-
- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md)
108+
- [Reference articles for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md)
102109
- [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md)
103110
- [macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos)
104111
- [Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md)

‎defender-xdr/investigate-alerts.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,8 +126,8 @@ Microsoft Defender XDR alerts come from solutions like Microsoft Defender for En
126126
| Microsoft Defender XDR | `ra{GUID}` <br> `ta{GUID}` for alerts from ThreatExperts <br> `ea{GUID}` for alerts from custom detections |
127127
| Microsoft Defender for Office 365 | `fa{GUID}` <br> Example: `fa123a456b-c789-1d2e-12f1g33h445h6i` |
128128
| Microsoft Defender for Endpoint | `da{GUID}` <br> `ed{GUID}` for alerts from custom detections |
129-
| Microsoft Defender for Identity | `aa{GUID}` <br> `ri{GUID}` <br> Example: `aa123a456b-c789-1d2e-12f1g33h445h6i`, `ri638724443630474445_-1629192583` |
130-
| Microsoft Defender for Cloud Apps |`ca{GUID}` <br> Example: `ca123a456b-c789-1d2e-12f1g33h445h6i` |
129+
| Microsoft Defender for Identity | `aa{GUID}` <br> `ri{GUID}` for alerts from XDR detection engine <br> Example: `aa123a456b-c789-1d2e-12f1g33h445h6i`, `ri638724443630474445_-1629192583` |
130+
| Microsoft Defender for Cloud Apps |`ca{GUID}` <br> `rm{GUID}` for alerts from XDR detection engine <br> Example: `ca123a456b-c789-1d2e-12f1g33h445h6i` |
131131
| Microsoft Entra ID Protection | `ad{GUID}` |
132132
| App Governance | `ma{GUID}` |
133133
| Microsoft Data Loss Prevention | `dl{GUID}` |

‎defender-xdr/whats-new.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,9 @@ You can also get product updates and important notifications through the [messag
3333
## January 2025
3434

3535
- **Defender Boxed** is available for a limited time in January and July of each year. This series of slides highlights your organization’s security successes, improvements, and response actions in the Microsoft Defender portal for the past six months/year. To learn how you can share your security operations team’s achievements, see [Defender Boxed](incident-queue.md#defender-boxed).
36+
- (GA) **Advanced hunting context panes** are now available in custom detection experiences. This allows you to access the advanced hunting feature without leaving your current workflow.
37+
- For incidents and alerts generated by custom detections, you can select **Run query** to explore the results of the related custom detection.
38+
- In the custom detection wizard's *Set rule logic* step, you can select **View query results** to verify the results of the query you are about to set.
3639

3740
## December 2024
3841

0 commit comments

Comments
 (0)