The Windows Server Summit 2019 is right around the corner and we don’t want you to miss out! Sign up for the virtual event occurring on May 22^nd, 2019 starting at 9:00 am PDT. During the event, hear Windows Server experts Jeff Woolsey and others cover the latest and greatest in Windows Server, Windows Admin Center, System Center and Azure Stack HCI.

Here are some of the hot topics we will talk about:

• Innovations in Microsoft’s Hybrid Strategy
• New ways to modernize Windows Server Apps and Workloads
• What’s new in Management and Security
• And much more!

Register today at: https://info.microsoft.com/Windows-Server-Summit-2019-Reg.html

We look forward to your attendance!

Thanks,

Yong

Protecting disconnected devices with Microsoft Defender ATP
https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-disconnected-devices-with-Microsoft-Defender-ATP/ba-p/500341

Applies to:

MacOS

Announcing Microsoft Defender ATP for Mac and new Threat and Vulnerability Management capabilities
https://www.microsoft.com/security/blog/2019/03/21/microsoft-defender-atp-for-mac-new-threat-and-vulnerability-management-capabilities/

Thanks,

Yong

P.S. Get the latest security stories from the Windows Defender Research team here:

Blog: Microsoft Secure Blog

Twitter: https://twitter.com/WDSecurity/

Facebook: https://www.facebook.com/MsftWDSI]]> https://docs.microsoft.com/archive/blogs/yongrhee/upgrade-windows-server-2008-r2-to-something-supported-before-jan-14th-2020-here-is-a-link-to-help-you Wed, 20 Mar 2019 16:53:48 GMT https://blogs.technet.microsoft.com/yongrhee/?p=8115 Applies to:

Windows Server 2008 R2 SP1

Windows Server 2008 SP2

Hello IT Architects and IT Admin’s.

The end of support (e.g. Security updates) for Windows Server 2008 R2 SP1 (and Windows Server 2008 SP2) is quickly approaching.

When is the end-of-support?

Jan. 14th, 2020.

In order to assist our customer migrate to a supported version of Windows Server 2016 or Windows Server 2019.

The following website https://www.microsoft.com/en-us/cloud-platform/windows-server-2008 has instructions on how you could move it.

• On-Premises Upgrade Center
• Assess
• Migrate
• Optimize

• Azure Migration Center
• Assess
• Migrate
• Optimize

It also contains free e-books for:
     Windows Server 2016 Guide
     Windows Server on Azure Guide

Thanks,

Yong

Are you in compliance with:

• EU General Data Protection Regulation (GDPR)
• and/or
• ISO 27001
• and/or
• ISO 27018
• and/or
• NIST 800- 53
• and/or
• NIST 800- 171
• and/or
• HIPAA

Use Compliance Manager to help meet data protection and regulatory requirements when using Microsoft cloud services
https://docs.microsoft.com/en-us/office365/securitycompliance/meet-data-protection-and-regulatory-reqs-using-microsoft-cloud

Manage Your Compliance from One Place – Announcing Compliance Manager
https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Manage-Your-Compliance-from-One-Place-Announcing-Compliance/ba-p/106493

Use Compliance Manager and Service Trust Portal to enhance your GDPR readiness
https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Use-Compliance-Manager-and-Service-Trust-Portal-to-enhance-your/ba-p/196965

Announcing Compliance Manager general availability
https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Announcing-Compliance-Manager-general-availability/ba-p/161922

• Compliance Manager Preview is now available
  https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Compliance-Manager-Preview-is-now-available/ba-p/124662

To give it a try:
https://aka.ms/STP and then click on “Compliance Manager” or go directly to it https://servicetrust.microsoft.com/ComplianceManager

Thanks,

Yong

Google Chrome

For those of us that use Microsoft Edge browser, we get the benefit of ‘additional security’.  Such as the virtualized container (sand-boxing) when using Microsoft Windows Defender Application Guard (WDAG) with Microsoft Edge browser.

In order to help end-users that are using Google Chrome with an additional layer of security, our Microsoft Windows Defender team created a new plugin to prevent Phishing attacks.

Blocking Phishing attacks (socially engineered malware) using Microsoft Edge browser.  The following is how the different browsers have scored based on a 3rd party test:

• Microsoft Edge blocked 99%
• Google Chrome blocked 87%
• Mozilla Firefox blocked 70%
       Source:  https://browserprotection.microsoft.com which redirects to https://microsoftedgewelcome.microsoft.com/en-us/safe/rs3

Do you want to make your Google Chrome browser more secure?  Add Windows Defender Browser Protection to Google Chrome browser.
https://chrome.google.com/webstore/detail/windows-defender-browser/bkbeeeffjjeopflfhgeknacdieedcoml

How to deploy it to your Enterprise environment?
Add Windows Defender Browser Protection to Chrome with Intune
https://blogs.technet.microsoft.com/cbernier/2018/04/25/add-windows-defender-browser-protection-to-chrome-with-intune/

Thanks,

Yong

P.S.  More information:

What else can I do to make Google Chrome and/or Mozilla Firefox more secure?

You could extend “Windows Defender Smartscreen” to these two 3rd party browsers using “Windows Defender Exploit Guard – Network Protection”, to learn more about it:

• Windows 10: Windows Defender Exploit Guard-Network Protection
  https://blogs.technet.microsoft.com/yongrhee/2019/02/26/windows-10-windows-defender-exploit-guard-network-protection/

Email Phishing Protection Guide – Part 10: Enable/Enforce SmartScreen for Microsoft Internet Explorer, Microsoft Edge, and Google Chrome
https://blogs.technet.microsoft.com/cloudready/2018/07/31/email-phishing-protection-guide-part-10-enableenforce-smartscreen-for-microsoft-internet-explorer-microsoft-edge-and-google-chrome/

(RDS) Tip of the Day: Windows Defender Browser Protection for Google Chrome
https://blogs.technet.microsoft.com/tip_of_the_day/2018/05/16/rds-tip-of-the-day-windows-defender-browser-protection-for-google-chrome/

Windows Defender Application Guard Standalone mode
https://techcommunity.microsoft.com/t5/Windows-Insider-Program/Windows-Defender-Application-Guard-Standalone-mode/td-p/66903

Introducing Windows Defender Application Guard for Microsoft Edge
https://blogs.windows.com/msedgedev/2016/09/27/application-guard-microsoft-edge/

[Where to download Outlook for the Apple iPhone (iOS)?]
Microsoft Outlook for Apple iPhone (iOS)
https://products.office.com/en-us/outlook-mobile-for-android-and-ios

or
Microsoft Outlook for Apple iPhone (iOS)
https://itunes.apple.com/us/app/microsoft-outlook/id951937596

[How to setup Office365 or Exchange Server and/or Hybrid?]
A new architecture for Exchange hybrid customers enables Outlook mobile and security
https://blogs.technet.microsoft.com/exchange/2018/04/02/a-new-architecture-for-exchange-hybrid-customers-enables-outlook-mobile-and-security/

Outlook app configuration – contact field export control
https://blogs.technet.microsoft.com/cbernier/2018/11/01/outlook-app-configuration-contact-field-export-control/

[How to manage Outlook for Apple iPhone (iOS) in Intune?]
New Outlook for iOS and Android App Config Policy Experience in Intune – Account Setup Config
https://blogs.technet.microsoft.com/exchange/2019/01/30/new-outlook-for-ios-and-android-app-config-policy-experience-in-intune-account-setup-config/

Now your enterprise mobility management solution can be used to simply set up and configure Outlook for iOS and Android for Exchange on-premises
https://blogs.technet.microsoft.com/exchange/2018/01/30/now-your-enterprise-mobility-management-solution-can-be-used-to-simply-set-up-and-configure-outlook-for-ios-and-android-for-exchange-on-premises/

[How to setup Outlook in your Apple iPhone (iOS)?]
Set up email in Outlook for iOS mobile app
https://support.office.com/en-us/article/Set-up-email-in-Outlook-for-iOS-mobile-app-b2de2161-cc1d-49ef-9ef9-81acd1c8e234

Synchronize Outlook and Apple iPhone or iPod touch contacts
https://support.office.com/en-us/article/Synchronize-Outlook-and-Apple-iPhone-or-iPod-touch-contacts-149CBFC5-4396-4AB3-8B65-22915E4043DC

Synchronize Outlook and Apple iPhone or iPod touch calendars
https://support.office.com/en-us/article/Synchronize-Outlook-and-Apple-iPhone-or-iPod-touch-calendars-BE7A12EB-FE76-4346-AE13-B54249DB7F9C

[Learn how to use Outlook in Apple iPhone (iOS)]

Microsoft Outlook for iOS and Android Customer Adoption Pack
https://www.microsoft.com/en-us/download/details.aspx?id=57479

Thanks,

Yong

P.S.  More information:

Outlook for iOS and Android Help
https://support.office.com/en-us/article/Outlook-for-iOS-and-Android-Help-cd84214e-a5ac-4e95-9ea3-e07f78d0cde6
Office 365 Weekly Digest | December 16 – 22, 2018
https://blogs.technet.microsoft.com/skywriter/2018/12/24/office-365-weekly-digest-2018-51/

Windows Server 2019
Windows 10 1809
Windows 10 1803
Windows 10 1709

Updated Mar. 3rd, 2019.

A few years ago (~3 years), I was waiting in the waiting room for my annual dental check-up.  The receptionist called me over and asked if I could help her with her Windows 7 SP1 machine where something had popped up.  It just happened that she unknowingly clicked on a link that had a ransomware payload…

Did the Windows 7 SP1 machine not have an antivirus?  Yes, it did have a 3rd party AV installed, but it didn’t have a ‘new’ definition.  Take a look at how the modern version of WD AV is able to “Block at First Sight” using Cloud Protection (which uses Machine Learning (ML), Artificial Intelligence (AI), Behavioral Monitoring (BM), and much more).

Long story short, I was able to salvage her Windows 7 SP1 machine, due to 1 flaw on the ransomware.  That 1 flaw on modern ransomwares have been taken care of by the bad personas.  And nowadays they (ransomware) look for mapped drives and network shares for maximum payload damage.

Fast forward to Oct of 2017 with the release of Windows 10 1709 and now as Oct of 2018 with Windows Server 2019, we now have an anti-ransomware functionality built-in.

Security Administrators, tired of the opportunistic ransomwares?
Protects sensitive data from ransomware by blocking untrusted processes from accessing your protected folders.

Windows Defender Exploit Guard: Controlled Folder Access, do I need Windows Defender Antivirus (WD AV)?

The answer is yes, you need WD AV to be enabled.

[What is Windows Defender Exploit Guard – Controlled Folder Access?]
Enable controlled folder access
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard

[What does WD Exploit Guard:  Controlled Folder Access block against?]

Ransomware: A declining nuisance or an evolving menace?
https://www.microsoft.com/security/blog/2017/02/14/ransomware-2016-threat-landscape-review/

Ransomware operators are hiding malware deeper in installer packages
https://www.microsoft.com/security/blog/2017/03/15/ransomware-operators-are-hiding-malware-deeper-in-installer-packages/

WannaCrypt ransomware worm targets out-of-date systems
https://www.microsoft.com/security/blog/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/

Windows 10 Creators Update provides next-gen ransomware protection
https://www.microsoft.com/security/blog/2017/06/08/windows-10-creators-update-hardens-security-with-next-gen-defense/

New ransomware, old techniques: Petya adds worm capabilities
https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Windows 10 platform resilience against the Petya ransomware attack
https://www.microsoft.com/security/blog/2017/06/29/windows-10-platform-resilience-against-the-petya-ransomware-attack/

Exploring the crypt: Analysis of the WannaCrypt ransomware SMB exploit propagation
https://www.microsoft.com/security/blog/2017/06/30/exploring-the-crypt-analysis-of-the-wannacrypt-ransomware-smb-exploit-propagation/

Stopping ransomware where it counts: Protecting your data with Controlled folder access
https://www.microsoft.com/security/blog/2017/10/23/stopping-ransomware-where-it-counts-protecting-your-data-with-controlled-folder-access/

Defending against ransomware using system design
https://www.microsoft.com/security/blog/2017/11/06/defending-against-ransomware-using-system-design/

Windows Defender Exploit Guard: Reduce the attack surface against next-generation malware
https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/

[So why Windows Defender Exploit Guard: Controlled Folder Access?]

Windows Defender Exploit Guard: Reduce the attack surface against next-generation malware
https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/

[Test / Deploy WD Exploit Guard:  Controlled Folder Access]
Evaluate controlled folder access
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access

Controlled Folder Access - Windows Defender Testground
https://demo.wd.microsoft.com/Page/CFA2

Allow a blocked app in Windows Security
https://support.microsoft.com/en-us/help/4046851/windows-10-allow-blocked-app-windows-security

List of attack surface reduction events such as for WD EG CFA:
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard#list-of-attack-surface-reduction-events

Use custom views to review in Event Viewer to review WD EG CFA:
XML for controlled folder access events
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard#xml-for-controlled-folder-access-events

Thanks,
Yong

P.S.  Related blog posts:

Windows 10: Windows Defender (WD) Antivirus (AV)
https://blogs.technet.microsoft.com/yongrhee/2019/02/21/windows-10-windows-server-2016-windows-server-2019-antivirus-av/

Windows 10: Windows Defender Exploit Guard-Exploit Protection
https://blogs.technet.microsoft.com/yongrhee/2019/02/21/windows-10-windows-defender-exploit-guard-exploit-protection/

Windows 10: Windows Defender Exploit Guard-Attack Surface Reduction rules
https://blogs.technet.microsoft.com/yongrhee/2019/02/24/windows-10-windows-defender-exploit-guard-attack-surface-reduction-rules/

Windows 10: Windows Defender Exploit Guard-Network Protection
https://blogs.technet.microsoft.com/yongrhee/2019/02/26/windows-10-windows-defender-exploit-guard-network-protection/

Applies to:
Windows Server 2019
Windows 10 1809
Windows 10 1803
Windows 10 1709

Windows Defender (WD) Exploit Guard (EG) – Network Protection (NP) extends the malware and social engineering (e.g. Phishing attacks) protection offered by Windows Defender SmartScreen (WD Smartscreen) in Microsoft Edge browser and Microsoft Internet Explorer; Covers 3rd party browsers such as Google Chrome, Mozilla Firefox and other applications to cover network traffic and connectivity (URL and/or IP address reputation) on your Windows 10 and Windows Server 2019 based systems.

In a shorter word, it extends (WD Smartscreen) to 3rd party apps.

Windows Defender Exploit Guard: Network Protection, do I need Windows Defender Antivirus (WD AV)?

The answer is yes, you need WD AV to be enabled.

[What is Windows Defender Exploit Guard – Network Protection?]

Protect your network
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard

Windows Defender Exploit Guard
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard

[So why Windows Defender Exploit Guard: Network Protection?]

Tackling phishing with signal-sharing and machine learning
https://cloudblogs.microsoft.com/microsoftsecure/2018/12/19/tackling-phishing-with-signal-sharing-and-machine-learning/

Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers
https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/

Windows Defender Exploit Guard: Reduce the attack surface against next-generation malware
https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/

Building Zero Trust networks with Microsoft 365
https://cloudblogs.microsoft.com/microsoftsecure/2018/06/14/building-zero-trust-networks-with-microsoft-365/

A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017
https://cloudblogs.microsoft.com/microsoftsecure/2018/01/10/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017/

Detonating a bad rabbit: Windows Defender Antivirus and layered machine learning defenses
https://cloudblogs.microsoft.com/microsoftsecure/2017/12/11/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses/

[Test / Deploy WD Exploit Guard: Network Protection]

Enable network protection
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection

Confirm pre-requisites
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np#confirm-pre-requisites
     Note:  Make sure that you are running the latest:

1. WD AV Platform update
2. WD AV Engine update
3. WD AV definition update

Allow the following URL's through proxy or firewall:

1. ars.smartscreen.microsoft.com
2. unitedstates.smartscreen-prod.microsoft.com
3. smartscreen-sn3p.smartscreen.microsoft.com

Reference:

Windows Defender Smartscreen reporting and notifications
https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1809-endpoints#windows-defender

Use audit mode to test the rule
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np#use-audit-mode-to-test-the-rule

Testing network protection feature
https://demo.wd.microsoft.com/Page/NP

List of 'attack surface reduction' events such as for WD EG NP:
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard#list-of-attack-surface-reduction-events

Use 'custom views' to review in 'Event Viewer' to review WD EG NP:
XML for network protection events
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard#xml-for-network-protection-events

Report a false positive or false negative
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np#report-a-false-positive-or-false-negative

Thanks,

Yong

P.S.  Related blog posts:
Windows 10/Windows Server 2016/Windows Server 2019 Antivirus (AV)
https://blogs.technet.microsoft.com/yongrhee/2019/02/21/windows-10-windows-server-2016-windows-server-2019-antivirus-av/

Windows 10: Windows Defender Exploit Guard-Exploit Protection
https://blogs.technet.microsoft.com/yongrhee/2019/02/21/windows-10-windows-defender-exploit-guard-exploit-protection/

Windows 10: Windows Defender Exploit Guard-Attack Surface Reduction rules
https://blogs.technet.microsoft.com/yongrhee/2019/02/24/windows-10-windows-defender-exploit-guard-attack-surface-reduction-rules/