In this demonstration, we'll use Group Policy.
I'm going to review how to set security settings for Windows Server
historically, and then we'll layer in some of those cloud services
that we learned about earlier in the module. You're looking at one of
my Windows Server 2022 desktops.
This is a domain controller.
Let me bring up my Group Policy Management MMC console.
Hopefully you're already familiar with Group Policy.
My friend and colleague, Darren Mar‑Elia, has done some really
nice Group Policy courses at Pluralsight, so if you're looking
for remedial action in that regard, I would check out Darren.
But, anyway,
you can see that my domain is called timw.info, and we're looking at the
default domain policy just as a representative example. Security
Filtering is set at the default, which is Authenticated Users, and
that's going to involve both users, groups, and computer accounts that
are authenticated to the domain.
We can right‑click and go to Edit. I already have the Edit
screen up here, and if we follow down the path under
Computer Configuration, Policies, Windows Settings,
Security Settings, Account Policies, we have Password Policy.
So this is the traditional control surface, where we've got password
history; maximum password age, 42 days; and we can either override
or not define the setting simply by unselecting it as the case may
be; minimum password length.
So this is the historical set of controls that
surfaced natively in Group Policy.
Now let's start to layer in, as I said,
some of these more advanced services and functions.
How about Exploit Guard? Remember that? We can find our Exploit Guard
under Administrative Templates, Windows Components, and then I was going
to look for Windows Defender Exploit Guard, and then I remembered it's
Microsoft Defender Exploit Guard.
And there's really just one policy here called Use a common set
of exploit protections so you can keep your configuration
centrally on a UNC path on your network.
It uses, unfortunately, the Extensible Markup Language, and
that's a way to centrally control Exploit Guard.
If we open up the Windows Security settings panel here,
we've got the client side that's available in Windows Client and Windows Server.
If we look at App & browser control,
let me turn that on, and then we can come into App & browser
control, the reputation‑based protection is SmartScreen and then we
have our Exploit protection. And as I said,
the System settings here are all predefined by Microsoft. They're
common hardware‑based vulnerabilities. And then we've got our
Program settings, where we can do overrides,
we can add additional programs to handle that in, so there is some
extensibility to the Exploit Guard functionality.
What about App Control,
Defender App Control? Let's see if I can find that in here.
So, again, we've got Computer Configuration, Administrative
Templates, and then we go under System, Device Guard.
And, again, we have that naming theme that I keep
mentioning, the product naming. Device Guard is what this
capability was originally called.
And we've got Deploy Windows Defender Application Control right here, and in
order to put this into effect, we'll need to have a policy file. Then
creating these assets, the XML for exploit protection,
the Code Integrity Policy file for Application Control, that level of
granularity is outside the scope of the exam, but as usual,
you'll want to set up the Microsoft docs,
in other words,
you want to query the Microsoft docs to set yourself up with those step‑by‑step
instructions to use this in the real world. For the purpose of AZ‑801, it's
sufficient that you understand what Defender Application Control does and where
the basic controls are, and as you can see,
it's natively in Windows Server Group Policy.
And then as far as Credential Guard,
the one that requires the virtualization‑based security,
it's actually in the same Group Policy path that's under Device
Guard, Turn On Virtualization Based Security.
And, again,
this is going to require that you've got platform or
motherboard‑based support in hardware for things like Secure Boot,
virtualization, extensions on your processors,
UEFI firmware, and so on.
So this is where you can start the path of configuring Credential
Guard protection on your machine, okay? So that is a bit of the old
and the new school just with typical Group Policy‑based management
controls in Windows Server 2022.
Now, let's take a look in more detail at the SmartScreen filter,
which is on by default.
You saw that we can get to its controls within the Windows
Security app, but how does it actually manifest itself by
default from an end user's point of view?
Well, the end user will find as they're using a browser like Edge, in particular,
I'm going to do a search for eicar test file.
This is a really nice way to test that your anti‑malware and your
vulnerability clients are actually working the way they should.
And I'm just going to attempt to bring down a .com file here. And you can see
that SmartScreen has launched into action here and reported reputationally
that that file is unsafe. And you can continue to the site, so that would be
an override that the user could do.
This involves a lot of user and administrator training it seems
to me. And if a user attempts to download,
say, a ZIP file that contains a malicious file,
you can see that by default Edge marks that ZIP as unsafe and refuses to download it, alright?