Skip to content

Commit f0b3672

Browse files
authored
Merge branch 'main' into docs-editor/investigate-users-1727439254
2 parents 6e9e38f + 74a536f commit f0b3672

File tree

58 files changed

+1707
-392
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+1707
-392
lines changed

.openpublishing.publish.config.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,18 @@
112112
},
113113
"build_entry_point": "docs",
114114
"template_folder": "_themes"
115+
},
116+
{
117+
"docset_name": "unified-secops-platform",
118+
"build_source_folder": "unified-secops-platform",
119+
"build_output_subfolder": "unified-secops-platform",
120+
"locale": "en-us",
121+
"monikers": [],
122+
"open_to_public_contributors": false,
123+
"type_mapping": {
124+
"Conceptual": "Content"
125+
},
126+
"build_entry_point": "docs"
115127
}
116128
],
117129
"notification_subscribers": [],

defender-endpoint/defender-endpoint-demonstration-controlled-folder-access.md

Lines changed: 50 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ ms.collection:
1414
- demo
1515
ms.topic: article
1616
ms.subservice: asr
17-
ms.date: 02/16/2024
17+
ms.date: 10/11/2024
1818
---
1919

2020
# Controlled folder access (CFA) demonstrations (block ransomware)
@@ -44,10 +44,10 @@ Set-MpPreference -ControlledFolderAccessProtectedFolders C:\demo\
4444
## Rule states
4545

4646
|State | Mode| Numeric value |
47-
|:---|:---|:---|
48-
| Disabled | = Off | 0 |
49-
| Enabled | = Block mode | 1 |
50-
| Audit | = Audit mode | 2 |
47+
|---|---|---|
48+
| Disabled | Off | 0 |
49+
| Enabled | Block mode | 1 |
50+
| Audit | Audit mode | 2 |
5151

5252
## Verify configuration
5353

@@ -63,65 +63,86 @@ Get-MpPreference
6363

6464
### Setup
6565

66-
Download and run this [setup script](https://demo.wd.microsoft.com/Content/CFA_SetupScript.zip). Before running the script set execution policy to Unrestricted using this PowerShell command:
66+
Download and run this [setup script](https://demo.wd.microsoft.com/Content/CFA_SetupScript.zip). Before running the script, set execution policy to `Unrestricted` by using this PowerShell command:
6767

6868
```powershell
6969
Set-ExecutionPolicy Unrestricted
7070
```
7171

72-
You can perform these manual steps instead:
72+
Or, you can perform these manual steps instead:
7373

74-
1. Create a folder under c: named demo, "c:\demo".
74+
1. Create a folder under `c:` named `demo`, as in `c:\demo`.
7575

76-
2. Save this [clean file](https://demo.wd.microsoft.com/Content/testfile_safe.txt) into c:\demo (we need something to encrypt).
76+
2. Save this [clean file](https://demo.wd.microsoft.com/Content/testfile_safe.txt) into `c:\demo` (we need something to encrypt).
7777

78-
3. Execute PowerShell commands listed earlier in this article.
78+
3. Run the PowerShell commands listed earlier in this article.
79+
80+
Next, check that status of the *Aggressive Ransomware Prevention* ASR rule and disable it for the duration of this test if it's enabled:
7981

80-
### Scenario 1: CFA blocks ransomware test file
8182

82-
1. Turn on CFA using PowerShell command:
83-
8483
```powershell
85-
Set-MpPreference -EnableControlledFolderAccess Enabled
84+
$idx = $(Get-MpPreference).AttackSurfaceReductionRules_Ids.IndexOf("C1DB55AB-C21A-4637-BB3F-A12568109D35")
85+
if ($idx -ge 0) {Write-Host "Rule Status: " $(Get-MpPreference).AttackSurfaceReductionRules_Actions[$idx]} else {Write-Host "Rule does not exist on this machine"}
8686
```
8787

88-
2. Add the demo folder to protected folders list using PowerShell command:
88+
If the rule exists and the status is `1 (Enabled)` or `6 (Warn)`, it must be disabled to run this test:
8989

9090
```powershell
91-
Set-MpPreference -ControlledFolderAccessProtectedFolders C:\demo\
91+
Add-MpPreference -AttackSurfaceReductionRules_Ids C1DB55AB-C21A-4637-BB3F-A12568109D35 -AttackSurfaceReductionRules_Actions Disabled
9292
```
9393

94-
3. Download the ransomware [test file](https://demo.wd.microsoft.com/Content/ransomware_testfile_unsigned.exe)
95-
4. Execute the ransomware test file *this isn't ransomware, it simple tries to encrypt c:\demo
94+
### Scenario 1: CFA blocks ransomware test file
95+
96+
1. Turn on CFA using PowerShell command:
97+
98+
```powershell
99+
Set-MpPreference -EnableControlledFolderAccess Enabled
100+
```
101+
102+
2. Add the demo folder to protected folders list using PowerShell command:
103+
104+
```powershell
105+
Set-MpPreference -ControlledFolderAccessProtectedFolders C:\demo\
106+
```
107+
108+
3. Download the ransomware [test file](https://demo.wd.microsoft.com/Content/ransomware_testfile_unsigned.exe).
109+
110+
4. Execute the ransomware test file. Note that it isn't ransomware; it simply tries to encrypt `c:\demo`.
96111

97112
#### Scenario 1 expected results
98113

99-
5 seconds after executing the ransomware test file you should see a notification CFA blocked the encryption attempt.
114+
About five seconds after executing the ransomware test file, you should see a notification that CFA blocked the encryption attempt.
100115

101116
### Scenario 2: What would happen without CFA
102117

103118
1. Turn off CFA using this PowerShell command:
104119

105-
```powershell
106-
Set-MpPreference -EnableControlledFolderAccess Disabled
107-
```
120+
```powershell
121+
Set-MpPreference -EnableControlledFolderAccess Disabled
122+
```
108123

109-
2. Execute the ransomware [test file](https://demo.wd.microsoft.com/Content/ransomware_testfile_unsigned.exe)
124+
2. Execute the ransomware [test file](https://demo.wd.microsoft.com/Content/ransomware_testfile_unsigned.exe).
110125

111126
#### Scenario 2 expected results
112127

113-
- The files in c:\demo are encrypted and you should get a warning message
128+
- The files in `c:\demo` are encrypted and you should get a warning message
114129
- Execute the ransomware test file again to decrypt the files
115130

116131
## Clean-up
117132

118-
Download and run this [cleanup script](https://demo.wd.microsoft.com/Content/ASR_CFA_CleanupScript.zip). You can perform these manual steps instead:
133+
1. Download and run this [cleanup script](https://demo.wd.microsoft.com/Content/ASR_CFA_CleanupScript.zip). You can perform these manual steps instead:
119134

120-
```powershell
121-
Set-MpPreference -EnableControlledFolderAccess Disabled
122-
```
135+
```powershell
136+
Set-MpPreference -EnableControlledFolderAccess Disabled
137+
```
138+
139+
2. Clean up `c:\demo` encryption by using the [encrypt/decrypt file](https://demo.wd.microsoft.com/Content/ransomware_cleanup_encrypt_decrypt.exe)
140+
141+
3. If the *Aggressive Ransomware Prevention* ASR rule was enabled and you disabled it at the beginning of this test, enable it again:
123142

124-
Clean up c:\demo encryption by using the [encrypt/decrypt file](https://demo.wd.microsoft.com/Content/ransomware_cleanup_encrypt_decrypt.exe)
143+
```powershell
144+
Add-MpPreference -AttackSurfaceReductionRules_Ids C1DB55AB-C21A-4637-BB3F-A12568109D35 -AttackSurfaceReductionRules_Actions Enabled
145+
```
125146

126147
## See also
127148

defender-endpoint/device-control-policies.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Learn about Device control policies in Defender for Endpoint
44
author: denisebmsft
55
ms.author: deniseb
66
manager: deniseb
7-
ms.date: 09/18/2024
7+
ms.date: 10/11/2024
88
ms.topic: overview
99
ms.service: defender-endpoint
1010
ms.subservice: asr
@@ -136,7 +136,7 @@ The following code snippet shows the syntax for a device control policy rule in
136136
</IncludedIdList>
137137
<ExcludedIdList>
138138
<GroupId>{3f5253e4-0e73-4587-bb9e-bb29a2171695}</GroupId>
139-
<ExcludedIdList>
139+
</ExcludedIdList>
140140
<Entry Id="{e3837e60-5e56-43ce-8095-043ccd793eac}">
141141
...
142142
</Entry>

defender-endpoint/enable-network-protection.md

Lines changed: 57 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Turn on network protection
33
description: Enable network protection with Group Policy, PowerShell, or Mobile Device Management and Configuration Manager.
44
ms.service: defender-endpoint
55
ms.localizationpriority: medium
6-
ms.date: 07/25/2024
6+
ms.date: 10/14/2024
77
ms.topic: conceptual
88
author: denisebmsft
99
ms.author: deniseb
@@ -19,20 +19,19 @@ search.appverid: met150
1919

2020
# Turn on network protection
2121

22-
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
23-
2422
**Applies to:**
2523

2624
- [Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
2725
- [Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
2826
- [Microsoft Defender XDR](/defender-xdr)
27+
- Microsoft Defender for Servers
2928
- Microsoft Defender Antivirus
3029

3130
**Platforms**
3231

3332
- Windows
34-
- Linux \(See [Network protection for Linux](network-protection-linux.md)\)
35-
- macOS \(See [Network protection for macOS](network-protection-macos.md)\)
33+
- Linux (See [Network protection for Linux](network-protection-linux.md))
34+
- macOS (See [Network protection for macOS](network-protection-macos.md))
3635

3736
> [!TIP]
3837
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-assignaccess-abovefoldlink)
@@ -43,27 +42,27 @@ search.appverid: met150
4342

4443
## Check if network protection is enabled
4544

46-
Check to see if network protection is enabled on a local device by using Registry editor.
45+
You can use Registry Editor to check the status of network protection.
4746

48-
1. Select the **Start** button in the task bar and type **regedit** to open Registry editor.
47+
1. Select the **Start** button in the task bar and type `regedit`. In the list of results, select Registry editor to open it.
4948

5049
2. Choose **HKEY_LOCAL_MACHINE** from the side menu.
5150

5251
3. Navigate through the nested menus to **SOFTWARE** \> **Policies** \> **Microsoft** \> **Windows Defender** \> **Policy Manager**.
5352

54-
If the Key is missing, Navigate to **SOFTWARE** \> **Microsoft** \> **Windows Defender** \> **Windows Defender Exploit Guard** \> **Network Protection**.
53+
If the key is missing, navigate to **SOFTWARE** \> **Microsoft** \> **Windows Defender** \> **Windows Defender Exploit Guard** \> **Network Protection**.
5554

5655
4. Select **EnableNetworkProtection** to see the current state of network protection on the device:
5756

58-
- 0, or **Off**
59-
- 1, or **On**
60-
- 2, or **Audit** mode
57+
- **0**, or **Off**
58+
- **1**, or **On**
59+
- **2**, or **Audit** mode
6160

62-
:::image type="content" source="/defender/media/95341270-b738b280-08d3-11eb-84a0-16abb140c9fd.png" alt-text="Network Protection registry key" lightbox="/defender/media/95341270-b738b280-08d3-11eb-84a0-16abb140c9fd.png":::
61+
:::image type="content" source="/defender/media/95341270-b738b280-08d3-11eb-84a0-16abb140c9fd.png" alt-text="Network Protection registry key" lightbox="/defender/media/95341270-b738b280-08d3-11eb-84a0-16abb140c9fd.png":::
6362

6463
## Enable network protection
6564

66-
Enable network protection by using any of these methods:
65+
To enable network protection, you can use one of the following methods:
6766

6867
- [PowerShell](#powershell)
6968
- [Mobile Device Management (MDM)](#mobile-device-management-mdm)
@@ -73,27 +72,34 @@ Enable network protection by using any of these methods:
7372

7473
### PowerShell
7574

76-
1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator**.
75+
1. On your Windows device, select Start, type `powershell`, right-click **Windows PowerShell**, and then select **Run as administrator**.
76+
77+
2. Run the following cmdlet:
7778

78-
2. Enter the following cmdlet:
79+
```PowerShell
80+
Set-MpPreference -EnableNetworkProtection Enabled
81+
```
7982

80-
```PowerShell
81-
Set-MpPreference -EnableNetworkProtection Enabled
82-
```
83+
3. For Windows Server, use the additional commands that listed in the following table:
8384

84-
3. Optional: Enable the feature in audit mode using the following cmdlet:
85+
| Windows Server version | Commands |
86+
|---|---|
87+
| Windows Server 2022 and later | `set-mpPreference -AllowNetworkProtectionOnWinServer $true` |
88+
| Windows Server 2016 <br/>Windows Server 2012 R2 | `set-MpPreference -AllowNetworkProtectionDownLevel $true` <br/> `set-MpPreference -AllowNetworkProtectionOnWinServer $true` |
8589

86-
```PowerShell
87-
Set-MpPreference -EnableNetworkProtection AuditMode
88-
```
90+
4. (This step is optional.) To set network protection to audit mode, use the following cmdlet:
8991

90-
To turn off the feature, use `Disabled` instead of `AuditMode` or `Enabled`.
92+
```PowerShell
93+
Set-MpPreference -EnableNetworkProtection AuditMode
94+
```
95+
96+
To turn off network protection, use the `Disabled` parameter instead of `AuditMode` or `Enabled`.
9197

9298
### Mobile device management (MDM)
9399

94-
Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](/windows/client-management/mdm/policy-csp-defender) configuration service provider (CSP) to enable or disable network protection or enable audit mode.
100+
1. Use the [EnableNetworkProtection](/windows/client-management/mdm/policy-csp-defender#enablenetworkprotection) configuration service provider (CSP) to enable or disable network protection or enable audit mode.
95101

96-
[Update Microsoft Defender antimalware platform to the latest version](https://support.microsoft.com/topic/update-for-microsoft-defender-antimalware-platform-92e21611-8cf1-8e0e-56d6-561a07d144cc) before you enable or disable network protection or enable audit mode.
102+
2. [Update Microsoft Defender antimalware platform to the latest version](https://support.microsoft.com/topic/update-for-microsoft-defender-antimalware-platform-92e21611-8cf1-8e0e-56d6-561a07d144cc) before you enable or disable network protection or enable audit mode.
97103

98104
### Microsoft Intune
99105

@@ -141,13 +147,13 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](/windows/
141147

142148
4. In the **Template name**, Choose **Endpoint protection** from the list of templates, and then select **Create**.
143149

144-
4. Go to **Endpoint protection** > **Basics**, provide a name for your profile, and then select **Next**.
150+
5. Go to **Endpoint protection** > **Basics**, provide a name for your profile, and then select **Next**.
145151

146-
5. In the **Configuration settings** section, go to **Microsoft Defender Exploit Guard** > **Network filtering** > **Network protection** > **Enable** or **Audit**. Select **Next**.
152+
6. In the **Configuration settings** section, go to **Microsoft Defender Exploit Guard** > **Network filtering** > **Network protection** > **Enable** or **Audit**. Select **Next**.
147153

148-
6. Select the appropriate **Scope tags**, **Assignments**, and **Applicability rules** as required by your organization. Admins can set more requirements.
154+
7. Select the appropriate **Scope tags**, **Assignments**, and **Applicability rules** as required by your organization. Admins can set more requirements.
149155

150-
7. Review all the information, and then select **Create**.
156+
8. Review all the information, and then select **Create**.
151157

152158
### Group Policy
153159

@@ -163,8 +169,7 @@ Use the following procedure to enable network protection on domain-joined comput
163169

164170
3. Expand the tree to **Windows components** \> **Microsoft Defender Antivirus** \> **Microsoft Defender Exploit Guard** \> **Network protection**.
165171

166-
> [!NOTE]
167-
> On older versions of Windows, the group policy path may say "Windows Defender Antivirus" instead of "Microsoft Defender Antivirus."
172+
Note that on older versions of Windows, the Group Policy path might have *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus*.
168173

169174
4. Double-click the **Prevent users and apps from accessing dangerous websites** setting and set the option to **Enabled**. In the options section, you must specify one of the following options:
170175

@@ -175,8 +180,7 @@ Use the following procedure to enable network protection on domain-joined comput
175180
> [!IMPORTANT]
176181
> To fully enable network protection, you must set the Group Policy option to **Enabled** and also select **Block** in the options drop-down menu.
177182
178-
> [!NOTE]
179-
> Optional: Follow the steps in [Check if network protection is enabled](#check-if-network-protection-is-enabled) to verify that your Group Policy settings are correct.
183+
5. (This step is optional.) Follow the steps in [Check if network protection is enabled](#check-if-network-protection-is-enabled) to verify that your Group Policy settings are correct.
180184

181185
### Microsoft Configuration Manager
182186

@@ -199,38 +203,34 @@ Use the following procedure to enable network protection on domain-joined comput
199203

200204
7. From the ribbon, select **Deploy** to deploy the policy to a collection.
201205

202-
> [!IMPORTANT]
203-
> Once you deploy an Exploit Guard policy from Configuration Manager, the Exploit Guard settings will not be removed from the clients if you remove the deployment. `Delete not supported` is recorded in the Configuration Manager client's ExploitGuardHandler.log if you remove the client's Exploit Guard deployment. <!--CMADO8538577-->
204-
> The following PowerShell script can be run under SYSTEM context to remove these settings:<!--CMADO9907132-->
205-
>
206-
> ```powershell
207-
> $defenderObject = Get-WmiObject -Namespace "root/cimv2/mdm/dmmap" -Class "MDM_Policy_Config01_Defender02" -Filter "InstanceID='Defender' and ParentID='./Vendor/MSFT/Policy/Config'"
208-
> $defenderObject.AttackSurfaceReductionRules = $null
209-
> $defenderObject.AttackSurfaceReductionOnlyExclusions = $null
210-
> $defenderObject.EnableControlledFolderAccess = $null
211-
> $defenderObject.ControlledFolderAccessAllowedApplications = $null
212-
> $defenderObject.ControlledFolderAccessProtectedFolders = $null
213-
> $defenderObject.EnableNetworkProtection = $null
214-
> $defenderObject.Put()
215-
>
216-
> $exploitGuardObject = Get-WmiObject -Namespace "root/cimv2/mdm/dmmap" -Class "MDM_Policy_Config01_ExploitGuard02" -Filter "InstanceID='ExploitGuard' and ParentID='./Vendor/MSFT/Policy/Config'"
217-
> $exploitGuardObject.ExploitProtectionSettings = $null
218-
> $exploitGuardObject.Put()
219-
>```
206+
#### Important information about removing Exploit Guard settings from a device
207+
208+
Once an Exploit Guard policy is deployed using Configuration Manager, Exploit Guard settings aren't removed from the clients if you remove the deployment. Furthermore, if you remove the client's Exploit Guard deployment, `Delete not supported` is recorded in the client's `ExploitGuardHandler.log` in Configuration Manager. <!--CMADO8538577-->
209+
210+
Use the following PowerShell script in the SYSTEM context to remove Exploit Guard settings correctly:<!--CMADO9907132-->
211+
212+
```powershell
213+
$defenderObject = Get-WmiObject -Namespace "root/cimv2/mdm/dmmap" -Class "MDM_Policy_Config01_Defender02" -Filter "InstanceID='Defender' and ParentID='./Vendor/MSFT/Policy/Config'"
214+
$defenderObject.AttackSurfaceReductionRules = $null
215+
$defenderObject.AttackSurfaceReductionOnlyExclusions = $null
216+
$defenderObject.EnableControlledFolderAccess = $null
217+
$defenderObject.ControlledFolderAccessAllowedApplications = $null
218+
$defenderObject.ControlledFolderAccessProtectedFolders = $null
219+
$defenderObject.EnableNetworkProtection = $null
220+
$defenderObject.Put()
221+
222+
$exploitGuardObject = Get-WmiObject -Namespace "root/cimv2/mdm/dmmap" -Class "MDM_Policy_Config01_ExploitGuard02" -Filter "InstanceID='ExploitGuard' and ParentID='./Vendor/MSFT/Policy/Config'"
223+
$exploitGuardObject.ExploitProtectionSettings = $null
224+
$exploitGuardObject.Put()
225+
```
220226

221227
## See also
222228

223229
- [Network protection](network-protection.md)
224-
225230
- [Network protection for Linux](network-protection-linux.md)
226-
227231
- [Network protection for macOS](network-protection-macos.md)
228-
229232
- [Network protection and the TCP three-way handshake](network-protection.md#network-protection-and-the-tcp-three-way-handshake)
230-
231233
- [Evaluate network protection](evaluate-network-protection.md)
232-
233234
- [Troubleshoot network protection](troubleshoot-np.md)
234235

235-
236236
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]

0 commit comments

Comments
 (0)