Windows 10 Enterprise E3 in CSP - Windows Deployment | Microsoft Docs
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Guide to Hardening Windows 10 Technical Guide
NOVEMBER 2020 Guide to Hardening Windows 10 For Administrators, Developers and Office Workers TABLE OF CONTENTS Introduction .......................................................................................................................... 4 Prerequisites ............................................................................................................................ 4 User roles ................................................................................................................................. 4 EFI (BIOS) Configuration ...................................................................................................... 5 To be enabled: ......................................................................................................................... 5 To be disabled: ......................................................................................................................... 5 Windows Defender Firewall .................................................................................................. 6 Enable logging of dropped packets ............................................................................................. 6 Disable enforcement of local rules and disable notifications .......................................................... 7 Block outbound connections by default ....................................................................................... 8 Secure potentially vulnerable protocols ...................................................................................... -
Implementing Remote Credential Guard and Remote Admin Mode on Domain-Joined Windows 10 Clients
INF258x: Implementing Remote Credential Guard and Remote Admin mode on Domain-joined Windows 10 Clients Estimated Time: 30 minutes You have a domain-joined Windows 10 client computer. You plan to take advantage of the Remote Desktop Credential Guard and Restrict Admin mode to protect credentials during Remote Desktop sessions between Windows 10 client and Windows Server 2016 computers. Objectives After completing this lab, students will be able to: • Implement Remote Credential Guard. • Implement the Restricted Admin mode. • Verify functionality of Remote Credential Guard and the Restricted Admin mode. Lab environment The lab consists of the following computers: • LON-DC1 – a Windows Server 2016 domain controller in the adatum.com single-domain forest. • LON-SVR1 – a Windows Server 2016 domain member server • LON-CL1 – a Windows 10 Pro or Enterprise version 1607 (or newer) domain member computer with Remote Server Administration Tools for Windows 10 All computers have Windows PowerShell Remoting enabled and have Internet connectivity Remote Desktop connections protected with Credential Guard have the following characteristics: • Require Windows 10 version 1607 (or newer) or Windows Server 2016 • Enforce of Kerberos authentication (NTLM is not allowed). • Require that both computers (a Remote Desktop client and a Remote Desktop host) are members of the same Active Directory domain or trusted Active Directory domains (Kerberos is enforced) • Support connecting with non-Administrative credentials (as a member of the Remote Desktop Users group) -
Feature Description
NTLM Feature Description UPDATED: 19 March 2021 NTLM Copyright Notices Copyright © 2002-2021 Kemp Technologies, Inc. All rights reserved. Kemp Technologies and the Kemp Technologies logo are registered trademarks of Kemp Technologies, Inc. Kemp Technologies, Inc. reserves all ownership rights for the LoadMaster and Kemp 360 product line including software and documentation. Used, under license, U.S. Patent Nos. 6,473,802, 6,374,300, 8,392,563, 8,103,770, 7,831,712, 7,606,912, 7,346,695, 7,287,084 and 6,970,933 kemp.ax 2 Copyright 2002-2021, Kemp Technologies, All Rights Reserved NTLM Table of Contents 1 Introduction 4 1.1 Document Purpose 6 1.2 Intended Audience 6 1.3 Related Firmware Version 6 2 Configure NTLM Authentication 7 2.1 Configure Internet Options on the Client Machine 7 2.2 Configure the LoadMaster 11 2.2.1 Enable NTLM Proxy Mode 13 2.2.2 Configure the Server Side SSO Domain 13 2.2.3 Configure the Client Side SSO Domain 15 2.2.4 Configure the Virtual Service 15 2.3 Configure Firefox to Allow NTLM (if needed) 17 2.4 Troubleshooting 18 References 19 Last Updated Date 20 kemp.ax 3 Copyright 2002-2021, Kemp Technologies, All Rights Reserved NTLM 1 Introduction 1 Introduction NT LAN Manager (NTLM) is a Windows Challenge/Response authentication protocol that is often used on networks that include systems running the Windows operating system and Active Directory. Kerberos authentication adds greater security than NTLM systems on a network and provides Windows-based systems with an integrated single sign-on (SSO) mechanism. -
Surface Hub 2S Admin Guide
Surface Hub 2S Admin Guide Surface Hub 2S coming soon; Pre-release products shown; products and features subject to regulatory certification/approval, may change, and may vary by country/region. Surface Hub 2S has not yet been authorized under U.S. Federal Communications Commission (FCC) rules; actual sale and delivery is contingent on compliance with applicable FCC requirements. This documentation is an early release of the final documentation, which may be changed prior to final commercial release and is confidential and proprietary information of Microsoft Corporation. This document is provided for informational purposes only and Microsoft makes no warranties, either express or implied, in this document. © 2019. Microsoft Corporation. All rights reserved Introduction .................................................................................................................................................. 1 Welcome to Surface Hub 2S ......................................................................................................................... 1 New User Experience and Features ........................................................................................................................ 1 Microsoft Teams ..................................................................................................................................................... 1 New form factor and hardware changes ................................................................................................................ 2 Surface -
Implementing Microsoft Credential Guard for Iso 27001, Pci, and Fedramp
IMPLEMENTING MICROSOFT CREDENTIAL GUARD FOR ISO 27001, PCI, AND FEDRAMP North America | Latin America | Europe 877.224.8077 | [email protected] | coalfire.com Coalfiresm and CoalfireOnesm are registered service marks of Coalfire Systems, Inc. All rights reserved. INTRODUCTION The threat of a cyber-attack is a constant factor all organizations must consider when developing their information security posture. A particular area of concern is the exploitation of information system derived domain credentials and credential artifacts, which present attackers the opportunity to pass-the-hash or pass-the-ticket with derived domain credentials such as NTLM password hashes or Kerberos tickets. Credential Guard is a set of new security features for Windows Server 2016 and the Windows 10 operating system which helps organizations prevent derived credentials from being compromised by advanced attacks or from being exposed during certain authentication workflows. In order to help customers implement this new capability for compliance with ISO, PCI, or FedRAMP, Microsoft worked closely with Coalfire, a recognized third-party IT compliance firm, to define each security and compliance objective in relation to the capabilities of Credential Guard. In addition, Appendix A contains mappings between Credential Guard and the security control requirements present in ISO 27001, PCI DSS, and FedRAMP. OVERVIEW OF CREDENTIAL GUARD Credential Guard provides robust protections against local pass-the-hash or pass-the-ticket attacks on derived credentials by providing advanced virtualization-based isolation for certain authentication workflows within normal Windows system operation. Previously, during authentication workflows that required NTLM or Kerberos authentication, Windows stored derived credentials in process memory associated with the Local Security Authority (LSA). -
Better Protection Begins at the OS
Windows Server 2016 Security Better protection begins at the OS 1 Contents Getting out in front of cyber attacks 3 How attacks work 3 Windows Server 2016: Active defense and compliance 4 Protect credentials and limit administrator privileges 5 Credential Guard 5 Remote Credential Guard 5 Just Enough and Just-in-Time Administration 5 Secure OS to run your applications and infrastructure 7 Device Guard 7 Control Flow Guard 7 Windows Defender 8 Enhanced security auditing 8 Secure virtualization 8 Shielded Virtual Machines 8 Host Guardian Service 10 Distributed network firewall using software-defined networking 10 Security for developers 11 Hyper-V containers 11 Nano Server 12 Conclusion 12 Windows Server begins at the OS 2016 Security: Better protection Getting out in front of cyber attacks n today’s business environment, cyber attacks file servers or locks employees out of their systems. Ihave become a normal occurrence for companies The attackers don’t even need to worry about of all sizes, across all industries. The attacker profile staying hidden on the network. has grown beyond independent actors, and now includes organized crime, nation states, and terror groups. These groups not only go after the biggest How attacks work companies to steal information for the biggest Most attackers use malware toolkits – available payoff, they are also focused on interrupting to anyone on the internet – to gain access to your businesses for profit or other malicious intent. network. Once inside, they immediately attempt Ransomware is another emerging threat used to to compromise administrator credentials, which disrupt business for financial gain. Attackers rely typically takes them 24 to 48 hours. -
Securing the Path to Windows 10 How to Achieve the Benefits of Virtualization-Based Security Without a Hardware Refresh White Paper
White Paper Securing the Path to Windows 10 How to Achieve the Benefits of Virtualization-based Security Without a Hardware Refresh White Paper Introduction “Bromium, a Microsoft partner, For enterprises the #1 reason to upgrade to Windows 10 is delivers hardware-enforced improved security, but the critical enhancements that rely on security to today’s deployed Windows endpoints. More hardware protection will be difficult to adopt until you buy importantly, Bromium enables new PCs. Bromium, a Microsoft partner, delivers hardware- IT organizations to easily upgrade existing PCs to Windows 10 with enforced security to today’s deployed Windows endpoints. More hardware-enforced security importantly, Bromium enables IT organizations to easily upgrade that extends the in-box security existing PCs to Windows 10 with hardware-enforced security that of Windows 10, without a hardware refresh, accelerating extends the in-box security of Windows 10, without a hardware Windows 10 rollouts.” refresh, accelerating Windows 10 rollouts. Windows 10 Security Windows 10 Enterprise promises many security enhancements over Windows 7 and 8, and introduces a family of hardware-assisted security technologies in Device Guard (DG). DG helps to ensure a secure boot, whitelists kernel code and offers credential protection and biometric authentication. The most important Figure 1: Windows 10 Device Guard SECURING THE PATH TO WINDOWS 10 2 White Paper “VBS uses endpoint CPU feature is virtualization-based security (VBS) which uses Hyper-V, enhanced with virtualization to isolate and elements of micro-virtualization, to help protect the operating system using protect two critical Windows hardware virtualization. The Bromium / Microsoft partnership aims to accelerate services: Windows Code Integrity service which protects the kernel the roadmap for VBS. -
Intelligent Security
Windows 10 Windows 10 Windows 10 Windows 10 Windows 10 Windows 10 commercial edition comparison Pro for Pro Business E3 E5 Workstation Per device Per device Per user Per user Per user Intelligent Security Threat protection Attack Surface Reduction ◑ ◑ ◕ ◕ ● Integrity enforcement of operating system boot up process Integrity enforcement of sensitive operating system components Advanced vulnerability and zero-day exploit mitigations Reputation based network protection for browsers Host-based firewall Ransomware mitigations Hardware based isolation for Microsoft Edge Application Control Device Control (e.g.: USB) Network protection for web-based threats Host intrusion prevention rules Enterprise management of hardware-based isolation for Microsoft Edge1 Customizable allow/deny lists (e.g.: IP/URL, Files, Certificates) Device-based conditional access Centrally manageable tamper protection of operating system Next Generation Protection ◑ ◑ ◑ ◑ ● Pre-execution emulation executables and scripts Runtime behavior monitoring In memory anomaly and behavior monitoring Machine learning and AI based protection from viruses and malware Published April 2020 v1909 1 Windows 10 Windows 10 Windows 10 Windows 10 Windows 10 Windows 10 commercial edition comparison Pro for Pro Business E3 E5 Workstation Per device Per device Per user Per user Per user Cloud protection for fastest responses to new/unknown web-based threats Protection from fileless based attacks Advanced machine learning and AI based protection for apex level viruses and malware threats Advanced -
Enabling Windows Server 2019 Device Guard and Credential Guard on Lenovo Thinksystem Servers
Front cover Enabling Windows Server 2019 Device Guard and Credential Guard on Lenovo ThinkSystem Servers Introduces the Device Guard and Provides steps to enable Device Credential Guard features Guard and Credential Guard Describes how to check the status Explains what Lenovo servers of the features support the features Guiqing Li Abstract Device Guard and Credential Guard are two important security features of the Microsoft Windows Server operating system that leverage virtualization capabilities from the hardware and the hypervisor to provide additional protection for critical subsystems and data. Customers can implement these features to secure their devices and data, such as user or system secrets, and hashed credentials. To benefit from these two features, the servers you are protecting must meet certain baseline hardware, firmware and software requirements. Lenovo® ThinkSystem™ servers support these two security features in conjunction with Windows Server 2019. This document introduces Device Guard and Credential Guard, and shows users how to enable them on supported Lenovo ThinkSystem servers. This paper is intended for IT specialists, technical architects and sales engineers who want to learn more about Device Guard and Credential Guard and how to enable them. It is expected that readers have some experience with Windows Server administration. At Lenovo Press, we bring together experts to produce technical publications around topics of importance to you, providing information and best practices for using Lenovo products and solutions to solve IT challenges. See a list of our most recent publications at the Lenovo Press web site: http://lenovopress.com Do you have the latest version? We update our papers from time to time, so check whether you have the latest version of this document by clicking the Check for Updates button on the front page of the PDF. -
Study on the Effects of New Information Technologies on the Abuse and Exploitation of Children
Study on the Effects of New Information Technologies on the Abuse and Exploitation of Children on the Technologies of New Information Study on the Effects Study on the Effects of New Information Technologies on the Abuse and Exploitation of Children UNITED NATIONS OFFICE ON DRUGS AND CRIME Vienna Study on the Effects of New Information Technologies on the Abuse and Exploitation of Children UNITED NATIONS New York, 2015 © United Nations, May 2015. All rights reserved, worldwide. This report has not been formally edited and remains subject to editorial changes. The contents of this report do not necessarily reflect the views or policies of UNODC or contributory organizations and neither do they imply any endorsement. The designations employed and the presentation of material in this publication do not imply the expression of any opinion whatsoever on the part of the Secretariat of the United Nations concerning the legal status of any country, territory, city or area, or of its authorities, or concerning the delimitation of its frontiers or boundaries. Information on uniform resource locators and links to Internet sites contained in the present publication are provided for the convenience of the reader and are correct at the time of issue. The United Nations takes no responsibility for the continued accuracy of that information or for the content of any external website. Publishing production: English, Publishing and Library Section, United Nations Office at Vienna. Acknowledgements This report was prepared pursuant to ECOSOC resolution 2011/33 on Prevention, protection and international cooperation against the use of new information technologies to abuse and/or exploit children by Conference Support Section, Organized Crime Branch, Division for Treaty Affairs, UNODC, under the supervision of John Sandage (former Director, Division for Treaty Affairs), Sara Greenblatt and Loide Lungameni (former and current Chief, Organized Crime Branch, respectively), and Gillian Murray (former Chief, Conference Support Section). -
CIS Microsoft Windows Server 2019 RTM (Release 1809) Benchmark
CIS Microsoft Windows Server 2019 RTM (Release 1809) Benchmark v1.0.0 - 08-30-2019 Terms of Use Please see the below link for our current terms of use: https://www.cisecurity.org/cis-securesuite/cis-securesuite-membership-terms-of-use/ 1 | P a g e Table of Contents Terms of Use ........................................................................................................................................................... 1 Overview ............................................................................................................................................................... 35 Intended Audience ........................................................................................................................................ 35 Consensus Guidance ..................................................................................................................................... 35 Typographical Conventions ...................................................................................................................... 36 Scoring Information ..................................................................................................................................... 36 Profile Definitions ......................................................................................................................................... 37 Acknowledgements ...................................................................................................................................... 39 Recommendations -
Security and Compliance in Microsoft Teams - Microsoft Teams | Microsoft Docs
3/26/2020 Overview of security and compliance in Microsoft Teams - Microsoft Teams | Microsoft Docs Security and compliance in Microsoft Teams 02/29/2020 • 9 minutes to read • +23 • Applies to: Microsoft Teams In this article Security Compliance Information Protection Architecture Licensing Location of data in Teams Compliance standards Related topics ) Important As a customer of Office 365, you own and control your data. Microsoft does not use your data for anything other than providing you with the service that you have subscribed to. As a service provider, we do not scan your email, documents, or teams for advertising or for purposes that are not service-related. Microsoft doesn’t have access to uploaded content. Like OneDrive for Business and SharePoint Online, customer data stays within the tenant. You can check out more about our trust and security related information at the Microsoft Trust Center. Teams follows the same guidance and principles as the Microsoft Trust Center. Microsoft Teams is built on the Office 365 hyper-scale, enterprise-grade cloud, delivering the advanced security and compliance capabilities our customers expect. For more information on planning for security in O365, please review our O365 content. The O365 security roadmap is a good place to start. For more information on planning for compliance in O365, you can start with the plan for security and compliance article. This article will provide further information about Teams-specific security and compliance. You should review these Microsoft Mechanics videos about security and compliance: Microsoft Teams Essentials for IT: Security and Compliance (12:42 min) Microsoft Teams Controls for Security and Compliance (10:54 min) https://docs.microsoft.com/en-us/microsoftteams/security-compliance-overview 1/8 3/26/2020 Overview of security and compliance in Microsoft Teams - Microsoft Teams | Microsoft Docs Security Teams enforces team-wide and organization-wide two-factor authentication, single sign-on through Active Directory, and encryption of data in transit and at rest.