Translate

Thursday, September 24, 2020

Microsoft Defender XDR

Upps they did it again. Another name change. But it make fully make sense! Microsoft Defender Advanced Threat Protection is becoming Microsoft Defender Endpoint Protection and much more! The whole thing is now Microsoft Defender XDR (eXtended Detection & Response)

Checkout this Microsoft Garage Video!


The Microsoft 365 Defender line will include:

  • Microsoft 365 Defender (previously Microsoft Threat Protection)
  • Microsoft Defender for Endpoint (previously Microsoft Defender Advanced Threat Protection)
  • Microsoft Defender for Office 365 (previously Office 365 Advanced Threat Protection)
  • Microsoft Defender for Identity (previously Azure Advanced Threat Protection)

Similarly, the Azure Defender line will include:

  • Azure Defender for Servers (previously Azure Security Center Standard Edition)
  • Azure Defender for IoT (previously Azure Security Center for IoT)
  • Azure Defender for SQL (previously Advanced Threat Protection for SQL)

Differences on Windows Versions Pro/Business/E3/E5

UPDATE 2021-05-10 (Update Link to PDF)

Recently a customer asked me about the specific differences between Windows Defender and Microsoft Defender Advanced Threat Protection (aka MD ATP or its new name "Microsoft Defender for Endpoints")


There is a great "Windows 10 commercial edition comparison" chart available which I want to share with you. Each feature is clickable and tells you more what MS is meaning with it!

Acutally the biggest differentiator is the security area. Standard security is pretty good so far even with Windows Defender (standalone). But the extra costs for E5 is bringing you cloud powered mega security facilitating the Microsoft Security Graph. So the extra bucks are running and operating the cloud facilities for you (hardware, power, cooling, people (3500 security researcher working for you day/night))

To see the full 8 pages version checkout here:
https://github.com/MicrosoftDocs/windows-itpro-docs/files/5363063/Windows10_CommercialEdition_Comparison.zip

Thanks to Simon for pointing me to this valuable ressource!

Thursday, August 6, 2020

How to change the number of days to revert to previous Windows Installation

Recently I got the question how to change the number of days for reverting Windows 10 to the previous Windows 10 version. Just in case e.g. your hardware or software is running into trouble. Default value is 10 days but this might be too less for strange issues comming up later.




In the web there are several ways to do it (like renaming the .old Folder etc.)

But the offical supported way is this one (problably set during a task sequence)


It is actually a DISM command.

/Set-OSUninstallWindow
Run this command against an online image to set the number of days after an upgrade that an uninstall can be initiated.
Syntax:
DISM /Online /Set-OSUninstallWindow /Value:<days>

Default is set to 10 days. Can be set between 2 – 60 days.

Tuesday, July 14, 2020

How to become a crack in Microsoft Defender ATP

Heike Ritter (Sr. PM of MD ATP) just shared a very interesting guide to become a professional threat hunter with Microsoft Defender ATP. And I think every professional in security operations should know this.




Its really worth to have a deeper look!


You get shown step by step how to become an advanced threat hunter. 

Monday, July 13, 2020

Autopilot Diagnostics

Just today the "Father" of Windows Autopilot (Michael Niehaus) just wrote a great article about  Windows Autopilot diagnostics. And I just refer to this article for you and me for later use. 



He is speaking about the "GET-AutopilotESPStatus" and its evolution to the Powershell Commandlet "Get-AutopilotDiagnostics" which it is now. And also about the different steps and even much more stuff to dig deeper into Autopilot diagnostics.

Feel free to have a deeper look into the Windows Autopilot diagnostics here:
https://oofhours.com/2020/07/12/windows-autopilot-diagnostics-digging-deeper/


And you get the original script here:
https://www.powershellgallery.com/packages/Get-AutopilotDiagnostics


Monday, June 22, 2020

Win10 - Patchday 06/2020 Printing Issues

Normally I do not comment temporary issues. Especially as MS is mostly fixing them within the next update period. Unfortunately for this issue it does not seem MS is deploying it via Windows Update even in the near future. Therefore here a short notice.

When your system get patched with the 06/2020 cumulative update you may see issues with your printers. It does not matter if it is a USB printer or otherwise connected printers. The root cause is in the printer spooler itself. 



For more official information's please refer to this KB article.

https://support.microsoft.com/en-us/help/4567512/windows-10-update-kb4567512

MS is providing manual hotfixes for this issue. Currently not deployed via Windows Update. If you encounter such a problem then please check out depending on your Win10 version these updates:

Thursday, June 18, 2020

Windows Virtual Desktop - FSLogix container size limitations

Recently a customer asked me about the Windows Virtual Desktop (WVD, now renamed to AVD - Azure Virtual Desktop)  FSLogix file storage limitations. After some research and talks to the Product Group it turns out that there are not really limitations by FSLogix by itself. The limitations are defined by the underlying technologies.





First of all FSLogix mainly used the standard container format .VHD/.VHDX
and these disks are stored on underlaying files storage technologies. In the WVD world this is in general Azure Files.

In terms of different disk types in general you can use all of them:

These are the size limitations of the container formats:

 Type      Size Limit Factor     Maximum Size Limit
 VHD Fixed Size
(recommended)
 Underlying Filesystem in general NTFS16 TB (4kb default cluster size)
256 TB (64kb cluster size)
 VHD
 Dynamic Size
 VHD specification (Word Document) 2040 GB (Theoretically)
127 GB (Practically e.g. ATA Hard
drive disk protocol limit)
 VHDX
 Fixed Size   
 Underlying Filesystem
 (Azure Files)
 64 TB (by VHDX definition)
 1 TB practically due to
 underlaying File System
 (e.g. Azure Files
 which is used in WVD)
 VHDX
 Dynamic Size
(recommended)
Used by default
from WVD
 Underlying Filesystem
 (Azure Files)
 64 TB (by VHDX definition)
 1 TB practically due to 
 underlaying File System

 (e.g. Azure Files 
 which is used in WVD)


Underlaying storage technology for FSLogix in Windows Virtual Desktop:

FSLogix Default for container disks is VHDX with Dynamic Size used on Azure Files. Maximum file size is up to 1 TB (as the file is set to dynamic it will start much smaller with the default profile size of your user profile and grow up the the specified limit. In this case the recommendation is to create dynamically VHDX files not greater than 1 TB).

When it comes to Azure Files there are more limits depending on the storage type you are using. A comprehensive list can be found here:
https://docs.microsoft.com/en-us/azure/storage/files/storage-files-scale-targets


Performance requirements per user:

This add another implication where you have to consider from the user side.
These are the performance and throughput requirements per User in FSLogix (thanks for Input from the PG)

The limitations (quotas) are usually not in FSLogix but in the underlying storage fabric that is being used to store FSLogix. Here are tables that show what FSLogix needs per one user. If we want to handle 100 users we need 1000 IOPS for steady used, 5000 IOPS for logon storm, etc.

 Steady IOPS used per user     10
 Boot / Login IOPS used per user                                   50

 Steady throughput per user (MB per second)        1.5 
 Boot / Login  throughput per user (MB per second)       7.5


Quota 

Technically you can setup quota for the user profiles in Windows directly. Due to the used filterdriver the user profile directory behaves like a native folder where quota can be applied. So if the admin sets a quota for the user profile you get notified as usual. There is no dedicated quota management in FSLogix necessary or available. (Thanks to Stefan for clarification!)