Now, what about Microsoft Defender protection products?
You notice I put a strikethrough through Windows,
and I did that kind of tongue in cheek.
Here's the situation. If you've been a Microsoft specialist for a while,
then you already know that Microsoft is known for branding and
rebranding and re‑rebranding their products.
It can be difficult to keep track.
Well,
some of these products have gone from being Windows
Defender to Microsoft Defender, and this is one of them.
Let's take a look at the product family.
I'm just going to say Defender here, but for the most part,
these products are branded as Microsoft Defender to reflect
the fact that a lot of these products,
because their cloud services can protect both Windows
and non‑Windows operating systems, both Microsoft and non‑Microsoft software,
you see. Defender for Endpoint is a host level antivirus,
anti‑malware solution client application. Defender for Identity, cloud‑based
solution that monitors your local Active Directory domains. Defender for Cloud
is built into Microsoft Azure that gives you hybrid cloud security hygiene.
Defender for Servers is a subset of Defender for Cloud that's geared
specifically for Windows Server and Linux machines both running in Azure, as
well as outside of Azure.
Those are all cloud‑based services.
Then we have system services like Defender Exploit Guard,
which we just discussed, and then yet to be discussed today
are Application Control and SmartScreen.
So the good news here is that under the Defender umbrella,
you have a lot of security tools at your disposal.
The bad news is that you may or may not see a reference to
Microsoft Defender or Windows Defender on your exam,
depending upon how current the exam is by the time you take it,
but don't sweat it.
Defender is Defender.
And if there's any dramatic name changes, I will call those out in the training.
All right,
so let's take a look next at Windows Defender
Application Control, or WDAC. What's this?
Well, this is taking the notion of trusted code to an extreme.
And I'm not saying that's a bad thing.
I'm saying that it can be a difficult thing,
particularly for businesses who have a server infrastructure
that's not really current or up to date.
Bottom line is that WDAC allows you to configure your Windows servers such that
only trusted or allowed device drivers and software can run.
There's two enforcement modes here, Audit Only and Enforcement Enabled.
You typically want to start with Audit Only just to iron out any
potential problems where you might get a false positive, an app
that should be allowed to run as blocked,
etc, or the inverse, and then once everything has been sufficiently tested,
you do Enforcement Enabled.
Now, a benefit of Defender Application Control is that
there are no system requirements.
By contrast, Credential Guard,
which we'll look at in a moment, uses hardware‑based
virtualization container infrastructure,
I think that's what HVCI means, but bottom line is, it requires compatible
hardware. Application Control you'd configure in software, but still you can
expect quite a bit of testing and refactoring because, you know, when you
think about a typical production server,
some are really single use and maybe they're not as difficult to have just a
strict allow list and then all other code is denied, but in smaller businesses
they may have a single server performing multiple roles and running different
line of business applications. So, you can expect to invest some work in
getting this to run, but again,
the benefit is if a server is breached and a malicious user
or process attempts to run code that's not allowed by your
Application Control policy, it won't be allowed to run, and that's what we want.
Now you might be thinking, Tim, well, this Application
Control sounds a bit like AppLocker.
AppLocker has been a Windows server feature for a number of years.
However,
it's basically deprecated. It's no longer receiving feature improvements.
So,
Microsoft really is steering customers that if you're looking for a way to
control systems such that they can only run authorized code,
you want to go for Defender Application Control,
which, like I said,
is a cloud service, so it has its own separate licensing scheme.
Now,
AppLocker, because it's not out of support totally, you could consider using it.
Microsoft recommends that AppLocker might be useful to support down level
Windows version, so if you have old Windows versions like 2012 R2,
let's say, or maybe even 2016, in other cases that you may not
need or want DLL or driver enforcement, AppLocker only allows you
to do scripts and binaries. WDAC allows you to manage DLL
libraries, as well as device drivers, so it's much richer in terms of its control surface.