{"id":89440,"date":"2019-05-21T09:00:43","date_gmt":"2019-05-21T16:00:43","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=89440"},"modified":"2023-05-15T23:10:06","modified_gmt":"2023-05-16T06:10:06","slug":"step-9-protect-your-os-top-10-actions-secure-your-environment","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/","title":{"rendered":"Step 9. Protect your OS: top 10 actions to secure your environment"},"content":{"rendered":"<p>In \u201cStep 9. Protect your OS\u201d of the <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/security-deployment-3\/\" target=\"_blank\" rel=\"noopener noreferrer\">Top 10 actions to secure your environment<\/a> blog series, we provide resources to help you configure Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) to defend your Windows, macOS, Linux, iOS, and Android devices from advanced threats.<\/p>\n<p>In an advanced threat, hackers and cybercriminals infiltrate your network through compromised users or vulnerable endpoints and can stay undetected for weeks\u2014or even months\u2014while they attempt to exfiltrate data and move laterally to gain more privileges. Microsoft Defender ATP helps you detect these threats early and take action immediately.<\/p>\n<p>Enabling Microsoft Defender ATP and related products will help you:<\/p>\n<ul>\n<li>Mitigate vulnerabilities.<\/li>\n<li>Reduce your attack surface.<\/li>\n<li>Enable next generation protection from the most advanced attacks.<\/li>\n<li>Detect endpoint attacks in real-time and respond immediately.<\/li>\n<li>Automate investigation and remediation.<\/li>\n<\/ul>\n<h3>Threat &amp; Vulnerability Management<\/h3>\n<p><strong>Threat &amp; Vulnerability Management<\/strong> is a new component of Microsoft Defender ATP that provides:<\/p>\n<ul>\n<li>Real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities.<\/li>\n<li>Linked machine vulnerability and security configuration assessment data in the context of exposure discovery.<\/li>\n<li>Built-in remediation processes through Microsoft Intune and Microsoft System Center Configuration Manager.<\/li>\n<\/ul>\n<p>To use <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/microsoft-defender-atp\/next-gen-threat-and-vuln-mgt\" target=\"_blank\" rel=\"noopener noreferrer\">Threat &amp; Vulnerability Management<\/a>, you\u2019ll need to turn on the <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/preview-windows-defender-advanced-threat-protection\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Defender ATP preview features<\/a>.<\/p>\n<h3>Attack surface reduction<\/h3>\n<p>Attack surface reduction limits the number of attack vectors that a malicious actor can use to gain entry. You can <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/configure-attack-surface-reduction\" target=\"_blank\" rel=\"noopener noreferrer\">configure attack surface reduction<\/a> through the following:<\/p>\n<ul>\n<li>Microsoft Intune<\/li>\n<li>System Center Configuration Manager<\/li>\n<li>Group Policy<\/li>\n<li>PowerShell cmdlets<\/li>\n<\/ul>\n<p>Enable these capabilities to reduce your attack surface:<\/p>\n<table>\n<tbody>\n<tr>\n<td width=\"234\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/overview-hardware-based-isolation\" target=\"_blank\" rel=\"noopener noreferrer\">Hardware-based isolation<\/a><\/td>\n<td width=\"497\">Configure Microsoft Defender Application Guard to protect your company while your employees browse the internet. You define which websites, cloud resources, and internal networks are trusted. Everything not on your list is considered untrusted.<\/td>\n<\/tr>\n<tr>\n<td width=\"234\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-application-control\/windows-defender-application-control\" target=\"_blank\" rel=\"noopener noreferrer\">Application control<\/a><\/td>\n<td width=\"497\">Restrict the applications that your users can run and require that applications earn trust in order to run.<\/td>\n<\/tr>\n<tr>\n<td width=\"234\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/device-guard\/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control\" target=\"_blank\" rel=\"noopener noreferrer\">Device control<\/a><\/td>\n<td width=\"497\">Configure Windows 10 hardware and software to &#8220;lock down&#8221; Windows systems so they operate with properties of mobile devices. Use configurable code to restrict devices to only run authorized apps.<\/td>\n<\/tr>\n<tr>\n<td width=\"234\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-exploit-guard\/exploit-protection-exploit-guard\" target=\"_blank\" rel=\"noopener noreferrer\">Exploit protection<\/a><\/td>\n<td width=\"497\">Configure Microsoft Defender Exploit Guard to manage and reduce the attack surface of apps used by your employees.<\/td>\n<\/tr>\n<tr>\n<td width=\"234\">Network protection<\/td>\n<td width=\"497\">Use network protection to prevent employees from using an application to access dangerous domains that may host phishing scams, exploits, and other malicious content.<\/td>\n<\/tr>\n<tr>\n<td width=\"234\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-exploit-guard\/controlled-folders-exploit-guard\" target=\"_blank\" rel=\"noopener noreferrer\">Controlled folder access<\/a><\/td>\n<td width=\"497\">Prevent apps that Microsoft Defender Antivirus determines are malicious or suspicious from making changes to files in protected folder.<\/td>\n<\/tr>\n<tr>\n<td width=\"234\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-firewall\/windows-firewall-with-advanced-security\" target=\"_blank\" rel=\"noopener noreferrer\">Network firewall<\/a><\/td>\n<td width=\"497\">Block unauthorized network traffic from flowing into or out of the local device.<\/td>\n<\/tr>\n<tr>\n<td width=\"234\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-exploit-guard\/attack-surface-reduction-exploit-guard\" target=\"_blank\" rel=\"noopener noreferrer\">Attack surface reduction controls<\/a><\/td>\n<td width=\"497\">Prevent actions and apps that are typically used by exploit-seeking malware to infect machines.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Next generation protection<\/h3>\n<p>The Intelligent Security Graph\u00a0powers the antivirus capabilities of Microsoft Defender Antivirus, which works with Microsoft Defender ATP to protect desktops, laptops, and servers from the most advanced ransomware, fileless malware, and other types of attacks.<\/p>\n<p><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-antivirus\/windows-defender-antivirus-in-windows-10\" target=\"_blank\" rel=\"noopener noreferrer\">Configure Microsoft Defender Antivirus<\/a> capabilities to:<\/p>\n<table>\n<tbody>\n<tr>\n<td width=\"294\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-antivirus\/utilize-microsoft-cloud-protection-windows-defender-antivirus\" target=\"_blank\" rel=\"noopener noreferrer\">Enable cloud-delivered protection<\/a><\/td>\n<td width=\"437\">Leverage artificial intelligence (AI) and machine learning algorithms to analyze the billions of signals on the Intelligent Security Graph and identify and block attacks within seconds.<\/td>\n<\/tr>\n<tr>\n<td width=\"294\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-antivirus\/specify-cloud-protection-level-windows-defender-antivirus\" target=\"_blank\" rel=\"noopener noreferrer\">Specify the cloud-delivered protection level<\/a><\/td>\n<td width=\"437\">Define the amount of information to be shared with the cloud and how aggressively new files are blocked.<\/td>\n<\/tr>\n<tr>\n<td width=\"294\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-antivirus\/configure-network-connections-windows-defender-antivirus\" target=\"_blank\" rel=\"noopener noreferrer\">Configure and validate network connections for Microsoft Defender Antivirus<\/a><\/td>\n<td width=\"437\">Configure firewall or network filtering rules to allow required URLs.<\/td>\n<\/tr>\n<tr>\n<td width=\"294\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-antivirus\/configure-block-at-first-sight-windows-defender-antivirus\" target=\"_blank\" rel=\"noopener noreferrer\">Configure the block at first sight feature<\/a><\/td>\n<td width=\"437\">Block new malware within seconds.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Endpoint detection and response<\/h3>\n<p>Microsoft Defender ATP <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/overview-endpoint-detection-response\" target=\"_blank\" rel=\"noopener noreferrer\">endpoint detection and response capabilities<\/a> detect advanced attacks in real-time and give you the power to respond immediately.\u00a0Microsoft Defender ATP correlates alerts and aggregates them into an incident, so you can understand cross-entity attacks (Figure 1).<\/p>\n<p>Alerts are grouped into an incident based on these criteria:<\/p>\n<ul>\n<li><strong>Automated investigation<\/strong> triggered the linked alert while investigating the original alert.<\/li>\n<li><strong>File characteristics<\/strong> associated with the alert are similar.<\/li>\n<li><strong>Manual association<\/strong> by a user to link the alerts.<\/li>\n<li><strong>Proximate time<\/strong> of alerts triggered on the same machine falls within a certain timeframe.<\/li>\n<li><strong>Same file<\/strong> is associated with different alerts.<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-1b.png\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-89444 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-1b.png\" alt=\"Image of the Windows Defender Security Center.\" width=\"1400\" height=\"795\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-1b.png 1400w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-1b-300x170.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-1b-768x436.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-1b-1024x581.png 1024w\" sizes=\"(max-width: 1400px) 100vw, 1400px\" \/><\/a><\/p>\n<p><em>Figure 1. Microsoft Defender ATP correlates alerts and aggregate them into incidents.<\/em><\/p>\n<p>Review your alerts and incidents on the <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/security-operations-dashboard-windows-defender-advanced-threat-protection\" target=\"_blank\" rel=\"noopener noreferrer\">security operations dashboard<\/a>. You can customize and filter the incident queue to help you focus on what matters most to your organization (Figure 2). You can also <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/alerts-queue-windows-defender-advanced-threat-protection\" target=\"_blank\" rel=\"noopener noreferrer\">customize the alert queue<\/a> view and the <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/machines-view-overview-windows-defender-advanced-threat-protection\" target=\"_blank\" rel=\"noopener noreferrer\">machine alerts view<\/a> to make it easier for you to manage.<\/p>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-2.png\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-89442 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-2.png\" alt=\"Image of a list of incidents in the Windows Defender Security Center.\" width=\"1460\" height=\"510\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-2.png 1460w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-2-300x105.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-2-768x268.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-2-1024x358.png 1024w\" sizes=\"(max-width: 1460px) 100vw, 1460px\" \/><\/a><\/p>\n<p><em>Figure 2. Default incident queue displays incidents seen in the last 30 days, with the most recent incident showing at the top of the list.<\/em><\/p>\n<p>Once you detect an attack that requires remediation, you can take the following actions:<\/p>\n<ul>\n<li><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/respond-machine-alerts-windows-defender-advanced-threat-protection\" target=\"_blank\" rel=\"noopener noreferrer\">Take response actions on a machine<\/a> &#8211; Isolate machines or collect an investigation package.<\/li>\n<li><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/respond-file-alerts-windows-defender-advanced-threat-protection\" target=\"_blank\" rel=\"noopener noreferrer\">Take response actions on a file<\/a> &#8211; Stop and quarantine files or block a file from your network.<\/li>\n<\/ul>\n<h3>Auto investigation and remediation<\/h3>\n<p>Microsoft Defender ATP can be <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/automated-investigations-windows-defender-advanced-threat-protection\" target=\"_blank\" rel=\"noopener noreferrer\">configured to automatically investigate and remediate alerts<\/a> (Figure 3), which will reduce the number of alerts your Security Operations team will need to investigate manually.<\/p>\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-3.png\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-89443 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-3.png\" alt=\"Image showing automated investigations in Microsoft Defender ATP.\" width=\"1579\" height=\"798\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-3.png 1579w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-3-300x152.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-3-768x388.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2019\/05\/Step-9-Protect-your-OS-image-3-1024x518.png 1024w\" sizes=\"(max-width: 1579px) 100vw, 1579px\" \/><\/a><\/p>\n<p><em>Figure 3. You can view the details of an automated investigation to see information such as the investigation graph, alerts associated with the investigation, the machine that was investigated, and other information.<\/em><\/p>\n<p><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/machine-groups-windows-defender-advanced-threat-protection\" target=\"_blank\" rel=\"noopener noreferrer\">Create and manage machine groups in Microsoft Defender ATP<\/a> to define automation levels:<\/p>\n<table>\n<tbody>\n<tr>\n<td width=\"264\"><strong>Automation level<\/strong><\/td>\n<td width=\"467\"><strong>Description<\/strong><\/td>\n<\/tr>\n<tr>\n<td width=\"264\">Not protected.<\/td>\n<td width=\"467\">Machines will not get any automated investigations run on them.<\/td>\n<\/tr>\n<tr>\n<td width=\"264\">Semi &#8211; require approval for any remediation.<\/td>\n<td width=\"467\">This is the default automation level.<br \/>\nAn approval is needed for any remediation action.<\/td>\n<\/tr>\n<tr>\n<td width=\"264\">Semi &#8211; require approval for non-temp folders remediation.<\/td>\n<td width=\"467\">An approval is required on files or executables that are not in temporary folders. Files or executables in temporary folders, such as the user&#8217;s download folder or the user&#8217;s temp folder, will automatically be remediated if needed.<\/td>\n<\/tr>\n<tr>\n<td width=\"264\">Semi &#8211; require approval for core folders remediation.<\/td>\n<td width=\"467\">An approval is required on files or executables that are in the operating system directories such as Windows folder and program files folder. Files or executables in all other folders will automatically be remediated if needed.<\/td>\n<\/tr>\n<tr>\n<td width=\"264\">Full &#8211; remediate threats automatically.<\/td>\n<td width=\"467\">All remediation actions will be performed automatically.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Microsoft Threat Experts<\/h3>\n<p><strong>Microsoft Threat Experts<\/strong> is a new, managed threat hunting service that provides proactive hunting, prioritization, and additional context and insights that further empower security operations centers (SOCs) to identify and respond to threats quickly and accurately with two capabilities:<\/p>\n<ol>\n<li><strong>Targeted attack notifications<\/strong>\u2014Alerts that are tailored to organizations provide as much information as can be quickly delivered to bring attention to critical network threats, including the timeline, scope of breach, and the methods of intrusion.<\/li>\n<li><strong>Experts on demand<\/strong>\u2014When a threat exceeds your SOC\u2019s capability to investigate, or when more actionable information is needed, security experts provide technical consultation on relevant detections and adversaries. In cases where a full incident response becomes necessary, seamless transition to Microsoft incident response services is available.<\/li>\n<\/ol>\n<p>Microsoft Defender ATP customers can <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/configure-microsoft-threat-experts\" target=\"_blank\" rel=\"noopener noreferrer\">register for Microsoft Threat Experts<\/a> and we will reach out to notify you via email when you&#8217;ve been selected.<\/p>\n<p><strong>Learn more<\/strong><\/p>\n<p>Check back in a few weeks for our final blog post in the series, \u201cStep 10. Detect and investigate security threats,\u201d which will give you tips to deploy Azure Advanced Threat Protection to detect suspicious activity in real-time.<\/p>\n<p><strong>Resources<\/strong><\/p>\n<ul>\n<li><a href=\"https:\/\/query.prod.cms.rt.microsoft.com\/cms\/api\/am\/binary\/RE2wYd3\" target=\"_blank\" rel=\"noopener noreferrer\">Top 10 Security Deployment Actions with Microsoft 365 infographic<\/a><\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/security-deployment-3\/\" target=\"_blank\" rel=\"noopener noreferrer\">Deployment blog series<\/a><\/li>\n<li><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-atp\/get-started\" target=\"_blank\" rel=\"noopener noreferrer\">Get started with Microsoft Defender ATP<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>The \u201cTop 10 actions to secure your environment\u201d series outlines fundamental steps you can take with your investment in Microsoft 365 security solutions. In \u201cStep 9. Protect your OS,\u201d you\u2019ll learn how to configure Microsoft Defender Advanced Threat Protection to prevent, detect, investigate, and respond to advanced threats.<\/p>\n","protected":false},"author":96,"featured_media":87340,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3659],"topic":[3672,3684],"products":[3690,3694],"threat-intelligence":[],"tags":[3825,3809],"coauthors":[1868],"class_list":["post-89440","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-best-practices","topic-endpoint-security","topic-security-operations","products-microsoft-defender","products-microsoft-defender-for-endpoint","tag-developers","tag-security-strategies"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Step 9. Protect your OS: top 10 actions to secure your environment<\/title>\n<meta name=\"description\" content=\"The \u201cTop 10 actions to secure your environment\u201d series outlines fundamental steps you can take with your investment in Microsoft 365 security solutions. In \u201cStep 9. Protect your OS,\u201d you\u2019ll learn how to configure Microsoft Defender Advanced Threat Protection to prevent, detect, investigate, and respond to advanced threats.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Step 9. Protect your OS: top 10 actions to secure your environment\" \/>\n<meta property=\"og:description\" content=\"The \u201cTop 10 actions to secure your environment\u201d series outlines fundamental steps you can take with your investment in Microsoft 365 security solutions. In \u201cStep 9. Protect your OS,\u201d you\u2019ll learn how to configure Microsoft Defender Advanced Threat Protection to prevent, detect, investigate, and respond to advanced threats.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2019-05-21T16:00:43+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-05-16T06:10:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png\" \/>\n\t<meta property=\"og:image:width\" content=\"720\" \/>\n\t<meta property=\"og:image:height\" content=\"420\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Debbie Seres\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Debbie Seres\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/debbie-seres\/\",\"@type\":\"Person\",\"@name\":\"Debbie Seres\"}],\"headline\":\"Step 9. Protect your OS: top 10 actions to secure your environment\",\"datePublished\":\"2019-05-21T16:00:43+00:00\",\"dateModified\":\"2023-05-16T06:10:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/\"},\"wordCount\":1234,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png\",\"keywords\":[\"Developers\",\"Security strategies\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/\",\"name\":\"Step 9. Protect your OS: top 10 actions to secure your environment\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png\",\"datePublished\":\"2019-05-21T16:00:43+00:00\",\"dateModified\":\"2023-05-16T06:10:06+00:00\",\"description\":\"The \u201cTop 10 actions to secure your environment\u201d series outlines fundamental steps you can take with your investment in Microsoft 365 security solutions. In \u201cStep 9. Protect your OS,\u201d you\u2019ll learn how to configure Microsoft Defender Advanced Threat Protection to prevent, detect, investigate, and respond to advanced threats.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png\",\"width\":720,\"height\":420,\"caption\":\"Image which reads \\\"Step 9.\\\"\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Step 9. Protect your OS: top 10 actions to secure your environment\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Step 9. Protect your OS: top 10 actions to secure your environment","description":"The \u201cTop 10 actions to secure your environment\u201d series outlines fundamental steps you can take with your investment in Microsoft 365 security solutions. In \u201cStep 9. Protect your OS,\u201d you\u2019ll learn how to configure Microsoft Defender Advanced Threat Protection to prevent, detect, investigate, and respond to advanced threats.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/","og_locale":"en_US","og_type":"article","og_title":"Step 9. Protect your OS: top 10 actions to secure your environment","og_description":"The \u201cTop 10 actions to secure your environment\u201d series outlines fundamental steps you can take with your investment in Microsoft 365 security solutions. In \u201cStep 9. Protect your OS,\u201d you\u2019ll learn how to configure Microsoft Defender Advanced Threat Protection to prevent, detect, investigate, and respond to advanced threats.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/","og_site_name":"Microsoft Security Blog","article_published_time":"2019-05-21T16:00:43+00:00","article_modified_time":"2023-05-16T06:10:06+00:00","og_image":[{"width":720,"height":420,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png","type":"image\/png"}],"author":"Debbie Seres","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png","twitter_misc":{"Written by":"Debbie Seres","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/debbie-seres\/","@type":"Person","@name":"Debbie Seres"}],"headline":"Step 9. Protect your OS: top 10 actions to secure your environment","datePublished":"2019-05-21T16:00:43+00:00","dateModified":"2023-05-16T06:10:06+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/"},"wordCount":1234,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png","keywords":["Developers","Security strategies"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/","name":"Step 9. Protect your OS: top 10 actions to secure your environment","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png","datePublished":"2019-05-21T16:00:43+00:00","dateModified":"2023-05-16T06:10:06+00:00","description":"The \u201cTop 10 actions to secure your environment\u201d series outlines fundamental steps you can take with your investment in Microsoft 365 security solutions. In \u201cStep 9. Protect your OS,\u201d you\u2019ll learn how to configure Microsoft Defender Advanced Threat Protection to prevent, detect, investigate, and respond to advanced threats.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/12\/EMS_Top_10_DeploymentActions_Step9_blog.png","width":720,"height":420,"caption":"Image which reads \"Step 9.\""},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/05\/21\/step-9-protect-your-os-top-10-actions-secure-your-environment\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"Step 9. Protect your OS: top 10 actions to secure your environment"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/89440"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=89440"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/89440\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/87340"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=89440"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=89440"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=89440"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=89440"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=89440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=89440"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=89440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}