Azure, Hybrid Identity & Enterprise Mobility + Security
Alongside the announcement of down-level support for Windows 7 and Windows 8.1, there is more exciting news in regards to Windows Defender ATP. Since today Windows Defender ATP Security Analytics is extended with two new security controls; BitLocker and Firewall.
Continue reading “Windows Defender ATP updates including BitLocker & Firewall security controls”
In this blog post I’ll explain how to configure and enable Windows Hello Multifactor Device Unlock using Microsoft Intune. Windows Hello Multifactor Device Unlock provides multifactor device authentication for login or unlocking Windows 10 devices.
Windows Hello for BusinessIn my previous blog I highlighted the Security Analytics Dashboard of the Windows Defender Advanced Threat Protection and how to improve your organizations security excellence covering two improvement area’s: Windows Defender Antivirus and Windows Defender Application Guard.
In this blog I’ll cover two other improvement areas: Windows Defender Exploit Guard and SmartScreen Continue reading “Part 2: Improve your endpoint security /w Windows Defender ATP & Microsoft Intune: Exploit Guard & SmartScreen”
Remark: Some information relates to pre-released product (Windows 10 Insiders Preview build) which may be substantially modified before it’s commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
In my previous blog I highlighted some of the new (preview) features – Security Analytics Dashboard – of Windows Defender Advanced Threat Protection (WDATP). In this blog I’ll go into more details how you can improve your organizations endpoint security posture by translating the actionable recommendations into Microsoft Intune device restrictions profiles (aka policies).
Windows Defender Advance Threat Protection
Windows Defender ATP sheds light on configuration issues and provide insights to machines where security features are not configured or out of date. It does provide actionable recommendations to improve your endpoint security. The actual actionable improvement must be performed by your administrator. In this blog I’ll explain how to improve the security baseline of your endpoints by using Microsoft Intune. Continue reading “Part 1: Improve your endpoint security /w Windows Defender ATP & Microsoft Intune: Windows Defender Antivirus & Application Guard”
With the recent release of Satya Nadella’s – Microsoft CEO – book and guide “Hit Refresh” to the future, it was a perfect occasion to deploy eBooks with Microsoft Intune. Earlier this year Microsoft introduced support for volume purchase (VPP) support for eBooks via Microsoft Intune.
Volume Purchase Program’s (e.g. Microsoft Store for Business, Apple Business Store) lets you purchase multiple licenses for a book that you want to distribute to users in your company. With Apple you can distribute books from the Business, or Education stores. Continue reading “Deploying Satya Nadella’s Guide “Hit Refresh” to the future /w Microsoft Intune eBooks”
Last week Microsoft announced the public preview of Windows Defender ATP Windows 10 Fall Creator update. I’m quite excited – we’ll should – of the new capabilities which allows you to better protect your endpoints from threats.
I had the opportunity to work with this for a while and like to highlight my personal favorite feature – Security Analytics Dashboard. Why? It’s because this feature gives me insights of my current endpoint (Windows 10, Windows Server, Linux* & Mac OS*) security posture and what it takes to utilize the full potential.
For a complete overview of all Windows Defender ATP preview features please read the official announcement here. Continue reading “Improve your endpoint security /w Windows Defender Advanced Threat Protection”
Note: the content in this blog post may subject to change as it’s based on Windows 10 Insider Preview build 16232/16237.
In the early days of Windows 8.x modern management made it’s appearance but due it’s limitations at that time not widely adopted.
The introduction of Windows 10 as the cloud OS with tight integration of Azure AD changed this rapidly. Combined with configuration service provider (CSP) modern management provides increased capabilities and therefore closing the gap with traditional management.
Another often-heard challenge of modern management is the troubleshooting part. This can sometimes be challenging as it is experienced as a black box. Common tools (e.g. Event Viewer, PowerShell, WMI) are sometimes cryptic and thus challenging to interpret, until today!
To illustrate the ease of troubleshooting (low entry), we configured a custom policy by Microsoft Intune which configures Windows Defender Application Guard (currently in preview) and check the process of the policy being applied on our endpoint .
Once assigned the policy in Microsoft Intune we triggered a policy refresh cycle.
Updated interface
In the updated GUI we can now determine which policy categories are configured, including our Windows Defender Application Guard (AppHVSI) policy. Besides the outline of the policy categories we can also determine the installed applications.
 |
 |
Management Diagnostic log files
The updated GUI goes beyond just displaying what is configured/applied and provides the ability drill down to our MDM configuration. The MDM configuration can be exported in a management log file which is exported in HTML format to C:\Users\Public\Documents\MDMDiagnostics\MDMDiagReport.html
The MDM diagnostic log file provides general information of your system. However the most interesting part is yet to come.
First of all it provides insights of the configuration sources and resource (CSPs) and whether it’s a device- or user based policy. The Resource section correlates to the various policies and installed apps. I highlighted a guid which correlates to an installed application.
Further it provides a detailed list of which policy categories are deployed by your MDM solution. These categories are listed in the updated interface I mentioned before. Further this section provides the detailed configuration of your policies.
In our scenario we deployed Windows Defender Application Guard policy. It shows you the policy area, default value, current value and whether it’s a device- or user based policy. It confirms the custom Windows Defender Application Guard Policy has been landed and successfully applied.
When looking under the hood we’ve the confirmation here too, Windows Defender Application Guard is configured properly. And mentioned earlier you’ll find the policy categories once again.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\AppHVSI
Complementary to the Windows Defender Application Guard CSP configuration you can keep track of the group policy (backed ADMX) equivalent.
Installed Applications
As mentioned before the MDM diagnostic log file also includes the list of installed applications through MDM channel.
Summary
The updated interface in this Windows 10 preview build is a simple as ingenious extension and help us to get useful insights to troubleshoot your modern management end-points.
Sources
Introduction to configuration service providers (CSPs) for IT pros
WindowsDefenderApplicationGuard CSP
https://docs.microsoft.com/en-us/windows/client-management/mdm/windowsdefenderapplicationguard-csp
Continue reading “Improved MDM diagnostics from Windows 10 Insider Preview #16232”
