Category: Thought experiment

Implement Microsoft Defender Antivirus – Manage, maintain, and protect devices

Malicious software can do many things to your computer, such as allowing unauthorized parties remote access to your computer or collecting and transmitting information that is sensitive or confidential to unauthorized third parties.

Some types of malware include:

  • Computer viruses Replicating malware, normally with email attachments or files.
  • Computer worms Replicate, without direct intervention, across networks.
  • Trojan horses Trick the user into providing an attacker with remote access to the infected computer.
  • Ransomware Harms the user by encrypting user data. A ransom (fee) needs to be paid to the malware authors to recover the data.
  • Spyware Tracking software that reports to the third party how a computer is used.

The most common attack vector for malware is still by email, although attacks from websites, pirated software, video, and music files are becoming increasingly common.

You can help protect against malware infection by following these guidelines:

  • All software should be from a reputable source.
  • All software and operating system updates are applied.
  • Antimalware software is installed and enabled on your devices.
  • Antimalware definitions are up to date.
  • Avoid using or accessing pirated software or media-sharing sites.
  • Be suspicious of out-of-the-ordinary email attachments, and don’t open links in spam or phishing emails.

Although no antimalware solution can provide 100 percent safety, modern solutions can reduce the probability that malware compromises your device.

Microsoft Defender Antivirus can help protect your device by actively detecting spyware, malware, and viruses in the operating system and on Windows 11 installed on Hyper-V virtual machines. Windows Defender runs in the background and automatically installs new definitions as they are released, often daily.

You can use Microsoft Defender Antivirus manually to check for malware with various scan options listed in Table 3-18.

TABLE 3-18 Microsoft Defender Antivirus scan options

Scan optionsDescription
QuickChecks the most likely areas that malware, including viruses, spyware, and software, commonly infect.
FullScans all files on your hard disk and all running programs.
CustomEnables users to scan specific drives and folders to target specific areas of their computers, such as removable drives.
Microsoft Defender Offline ScanAllows users to find and remove difficult-to-remove malicious software. The system must reboot, and the scan can take about 15 minutes.

You should routinely check your system for malware. If it becomes infected or you suspect malware is on your system, you can run a full scan.

Implement endpoint protection for all supported device platforms – Manage, maintain, and protect devices

Windows 11 contains a number of built-in features that are part of the Microsoft Defender suite of security apps. It’s important that you are familiar with each of these, you can determine what they do, you know how they can help secure your organization’s devices, and you know how you can enable and configure these features. You must also understand how to implement, configure, and manage these security features by using Microsoft Intune.

This skill covers how to:

Create and manage configuration policies for Endpoint security

In this section, you’ll learn how to secure your Windows 11 devices. You’ll also learn about the various security features in Windows 11.

Implement enterprise-level disk encryption

It’s important to be able to protect your computers against data loss and data leakage. One way in which you can do this is to enable disk encryption. Windows 11 supports BitLocker.

BitLocker enables you to encrypt an entire hard disk, including the operating system drive. BitLocker is available in Windows 11 Pro, Enterprise, and Education editions.

With BitLocker enabled, the drive is no longer susceptible to data theft. On a system that is not encrypted simply removing the drive from the PC and attaching it as a slave to another PC allows the data to be read, bypassing all NTFS security.

Trusted Platform Modules

Most modern computers contain a security component known as a Trusted Platform Module (TPM). This component securely stores cryptographic information, such as BitLocker’s encryption keys.

BitLocker supports versions 1.2 and 2.0 of the TPM specification, and information contained on the TPM is more secure from external software attacks and physical theft.

If a device has been tampered with, such as removing the hard drive from the original computer, BitLocker prevents the drive from being unlocked. BitLocker will seek remediation from the user by entering BitLocker recovery mode and requiring the user to enter a 48-digit recovery key.

While a TPM is the most secure option, BitLocker can also be used on devices without a TPM. To enable this capability, you must configure the appropriate settings in Intune, and we’ll discuss those shortly.

BitLocker Recovery – Manage, maintain, and protect devices

If your users’ computers experience a situation where BitLocker will not unlock their operating system drive, they must enter a recovery key, as mentioned earlier. You can store and access the keys using Intune.

To access the BitLocker key for a user, use the following procedure:

  1. In the Microsoft Intune admin center, navigate to Devices and select Windows devices.
  2. Locate the device in the list of Windows devices and then select it.
  3. In the navigation pane, select Recovery keys.
  4. In the details pane, select Show Recovery Key.
  5. Provide the key to the user to unlock their drive.

Implement and manage Microsoft Defender Credential Guard

When users sign in, they provide their user credentials via the Local Security Authority subsystem (LSA) to an authentication service. These user credentials are stored temporarily in memory in the LSA as hashes. Certain malicious software can access the LSA and exploit the stored hashes.

To help protect against this possibility, Windows 11 Enterprise and Windows 11 Education editions have a feature called Microsoft Defender Credential Guard, which implements virtualization-assisted security technology, enabling Microsoft Defender Credential Guard to block access to credentials stored in the Local Security Authority.

Requirements

In addition to requiring the appropriate edition of Windows 11, the following are the requirements for implementing Microsoft Defender Credential Guard:

  • Support for Virtualization-based security.
  • UEFI 2.3.1 or greater.
  • Secure Boot.
  • TPM 1.2 or 2.0, either discrete or firmware.
  • UEFI (firmware) lock preferred.
  • Virtualization features: Intel VT-x or AMD-V; SLAT must be enabled.
  • Windows hypervisor, although Hyper-V doesn’t need to be installed.

Implement Microsoft Defender Credential Guard

After verifying that your computer meets the requirements, you can enable Microsoft Defender Credential Guard by using Group Policy or Microsoft Intune. To use Intune, perform the following steps:

  1. Open Microsoft Intune admin center.
  2. Navigate to Endpoint security and select Account protection.
  3. In the details pane, select Create Policy.
  4. On the Create a profile page, displayed in Figure 3-55, in Platform, select Windows 10 and later, and in the Profile list, choose Account protection.

FIGURE 3-55 Enabling Microsoft Defender Credential Guard

  1. Click Create.
  2. In the Create profile wizard, on the Basics tab, enter a Name and Description and click Next.
  3. On the Configuration settings page, select Enable with UEFI lock in the Turn on Credential Guard list and click Next.
  4. Complete the wizard by defining scope tags and assignments and click Create on the Review + create page.

You can also use a configuration profile of type Endpoint protection:

  1. Select Devices, select Windows, and then select Configuration profiles.
  2. Select Create profile, and in the Platform list, select Windows 10 and later.
  3. In the Profile type list, select Templates.
  4. In the list of templates, select Endpoint protection, and click Create.
  5. On the Configuration settings page, expand Microsoft Defender Credential Guard and configure the desired settings.

Need More Review? Manage Microsoft Defender Credential Guard

To review further details about how Microsoft Defender Credential Guard works, refer to the Microsoft website at https://learn.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage.

Troubleshoot updates in Intune – Manage, maintain, and protect devices

Updates are necessary to maintain the security and reliability of Windows 11. You should ensure that devices are receiving updates, know how to review installed updates, and find more information regarding an update.

After you have created your Windows 11 Update Rings, you can manage them with Intune. Select the appropriate update ring, and on the Overview page, you can view the assignment status, showing that the ring has been successfully assigned to one group, and take the following actions to manage the ring:

  • Delete Stops enforcing the settings of the Update Ring and removes its configuration from Intune. The settings on devices that were assigned to the Update Ring remain in place.
  • Pause Prevents assigned devices from receiving either Feature Updates or Quality Updates for up to 35 days from the time you pause the ring. Pause functionality automatically expires after 35 days.
  • Resume Used to restore an Update Ring that was paused.
  • Extend When an Update Ring is paused, you can select Extend to reset the pause period.
  • Uninstall Use Uninstall to uninstall (roll back) the latest Feature Update or Quality Update on a device running Windows 11.

You can also modify the settings contained within an Update Ring by selecting Properties under the Manage heading and then amending the settings.

View update history

You can also review and remove any specific updates on an individual computer. Follow these steps to view your update history and see which Windows updates failed or were successfully installed on your Windows 11 device:

  1. Open the Settings app and click Windows Update.
  2. In Windows Update, click Update History.
  3. On the Update History page, as shown in Figure 3-52, you can see a list of your installed Windows updates.

FIGURE 3-52 View Update History

  1. Click one of the successfully installed updates to see more details about it.
  2. In the bottom part of the screen, you can view Definition Updates, which relate to Microsoft Defender Antivirus and threat protection, and Other Updates.

Each update contains a summary of the payload. If you click the Update link, you are directed to the detailed Knowledge Base description on the Microsoft support pages relating to the update, which allows you to review the details about the update. You can also remove any updates you want. Click Uninstall updates, and then review the returned list. Choose Uninstall for any updates you want to remove.
Need More Review? Windows 11 Update History
Microsoft publishes the contents of each Windows 11 update for you to review and understand what is contained in each periodic software update. View this list at https://support.microsoft.com/en-us/topic/windows-11-version-22h2-update-history-ec4229c3-9c5f-4e75-9d6d-9025ab70fcce.

Implement Windows Defender Firewall – Manage, maintain, and protect devices

You can implement Windows Defender Firewall rules and settings in Intune as follows:

  1. Open Microsoft Intune admin center.
  2. Navigate to Endpoint security and select Firewall.
  3. In the details pane, select Create Policy.
  4. On the Create a profile page, in Platform, select Windows 10, Windows 11, and Windows Server.
  5. In the Profile, select Microsoft Defender Firewall, and then select Create.
  6. In the Create a profile wizard, on the Basics tab, enter a Name and Description and click Next.
  7. On the Configuration settings tab, configure the following settings, and click Next:
    • Firewall, which determines the fundamental state of the firewall for domain, private, and public network location profiles.
    • Auditing settings.
    • Network List Manager, which defines TLS endpoint settings.
  8. Configure scope tags and assignments as needed, and then choose Create to create the profile.

You will also need to define firewall rules, as shown in Figure 3-60. Use the following procedure:

  1. Open Microsoft Intune admin center.
  2. Navigate to Endpoint security and select Firewall.
  3. In the details pane, select Create Policy.
  4. On the Create a profile page, in Platform, select Windows 10, Windows 11, and Windows Server.
  5. In the Profile, select Microsoft Defender Firewall rules, and then select Create.
  6. In the Create a profile wizard, on the Basics tab, enter a Name and Description and click Next.
  7. On the Configuration settings tab, click Add to create and configure specific firewall rules. When you are done, click Next. When adding a rule, you must set numerous settings, including
    • State (enabled or disabled)
    • Name
    • Interface Types
    • Remote Port Ranges
    • Action (Allow or Block)
    • Protocol
  8. Configure scope tags and assignments as needed, and then Create the profile.

FIGURE 3-60 Defining firewall rules
You can also create an endpoint protection configuration profile in Devices and configure the required firewall settings in the Microsoft Defender Firewall section.

Implementing Microsoft Defender Exploit Guard – Manage, maintain, and protect devices

Having learned about each of the elements of Exploit Guard, it’s important that you know how to enable and configure these settings in Intune. Use the following procedure:

  1. Open Microsoft Intune admin center.
  2. Navigate to Devices and then select Windows.
  3. Click Configuration profiles.
  4. Click Create profile.
  5. On the Create a profile page, select Windows 10 and later and then select Templates.
  6. In the list of templates, select Endpoint protection and click Create.
  7. Enter a Name and Description on the Basics tab, and then, on the Configuration settings page, expand Microsoft Defender Exploit Guard.
  8. As shown in Figure 3-57, configure the required settings in the following folders:
    • Attack Surface Reduction Select the desired protections.
    • Controlled folder access Enable the setting and define apps and folders.
    • Network filtering Enable the setting or enable in Audit mode.
    • Exploit protection Browse and locate a previously created XML file that contains exploit settings you exported from the Windows Security app on a properly configured device.

FIGURE 3-57 Configuring Exploit Guard settings

  1. Click Next, configure scope tags and assignments as necessary, and then Create the profile.

Implement Microsoft Defender Application Guard

Microsoft Defender Application Guard isolates browser sessions from the local device by running those sessions in a virtual machine environment; this helps prevent malicious apps or content from accessing the local device.

Requirements

The requirements for Microsoft Defender Application Guard are as follows:

  • 64-bit version of Windows 11 Enterprise, Education, or Professional.
  • 8 GB of physical memory is recommended.
  • Support for Virtualization-based security.
  • Secure Boot.
  • Virtualization features: Intel VT-x, AMD-V, and SLAT must be enabled.
  • An Intel VT-d or AMD-Vi input-output memory management unit.