Best new Windows 10 security features: Windows Sandbox, more update options

Here's what you need to know about each security update to Windows 10 as they roll out from Microsoft. Now updated for the 1903 feature release.

1 2 3 4 Page 2
Page 2 of 4

Changes have been made to allow BitLocker to be enabled on devices that don’t pass the Hardware Security Test Interface (HSTI). You can also deliver BitLocker policy to AutoPilot devices during Out of box experience process.

Windows Defender Application Guard improvements

If the device supports the settings, Windows Defender Application Guard settings can now be set in the Windows Security interface rather than merely through registry keys. The requirements to enable Application Guard to include having the hardware support Second Level Address Translation (SLAT) and either VT-x (Intel) or AMD-V virtualization extensions for virtualization-based security (VBS).

The new user interface allows end users to review settings their system administrator has made so they understand the behavior that they are seeing. The four settings that can be configured for Application Guard in the Windows Security app are Save data, Copy and paste, Print files and Advanced graphics. These settings impact as follows:

When you browse in Application Guard for Microsoft Edge, certain actions can be disabled. If save data is disabled, users are blocked from saving data while browsing using Application Guard for Microsoft Edge. Turning off copy-and-paste blocks the ability to copy and paste to and from the isolated browser. Disabling print files blocks the ability to print from Edge. Finally, disabling Advanced Graphics improves video and graphics performance with Hyper-V virtualization technology.

To enable these settings, open Windows Security and click on the App & browser control icon. Then click on the “Change Application Guard settings” link under the Isolated browsing section and make the adjustments. Then reboot the computer.

All these features strengthen the security of the Windows operating system. For even more security, configure dedicated workstations or virtual machines with Privileged Access Workstations combined with Azure AD Privileged Identity Management to access sensitive premises and cloud assets.

While 1809 doesn’t bring major changes in security, it is once again an incremental feature release that provides the enterprise to make it that much harder for attackers to infiltrate systems.

Windows 10 1803

This edition was slated to be released in March 2018. Due to quality and release issues including reported blue screens of death in some of the final testing releases, the feature release date was postponed to April 30. It is encouraging to see that Microsoft is putting an emphasis on quality and not just depending on shipping the feature update as a key milestone.

For best results, install your video driver and motherboard updates before installing any feature update. It’s also wise to reach out to your vendors, specifically for any third-party security software you depend on. Many have security software releases ready to go as Windows 1803 is released. Others might need time to revise their software to work with the new edition.

Windows 1803 is deemed to be in semi-annual targeted release. Enterprises should test and confirm that the update is acceptable to the business. In a few months when Microsoft declares the software is “semi-annual channel,” it’s deemed to be ready for businesses to fully deploy and for broader release. When Microsoft announces that release date, it will be re-released to the Windows Software Update Services channel and other enterprise patching platforms to allow for broader release.

The next feature release is expected in the September time frame. Windows is also aligning its feature release timetable with Office 365 releases. Even though there are only six months between feature releases, Microsoft supports each individual release for a reasonable about of time. Normally, Microsoft supports a Windows 10 edition with quality (security) updates for 18 months. Due to changes in Office, it added six months of support to 1607, 1703, and 1709 versions. Thus, you can choose to skip one version and jump over to the next in your deployment methodology.

Here are just a few reasons that you might want to deploy 1803 sooner versus later:

Privacy features

The European Union EU) is putting into place new rules to ensure privacy for EU citizens in the form of General Data Protection Regulations (GDPR). While not a requirement of GDPR, 1803 exposes what Microsoft is collecting from your system regarding telemetry.

Microsoft uses telemetry to track what features you use, the success or failure of updates, and various other settings. Enterprises in sensitive industries are often concerned that no information can be shared for any reason. Before the release of 1803, if you wanted to block all telemetry and still receive Windows updates, you needed to upgrade to the Windows Enterprise version to block telemetry and still receive updates.

To use and view the new Diagnostic Data Viewer you have to enable it in Settings. Then go to Privacy then go to Diagnostics & Feedback. Then click “Diagnostic Data Viewer” to download the tool from the Windows store.

WIndows 10 1803 Susan Bradley

Diagnostic Data Viewer is downloadable from the Windows Store

You can now launch and review what is being sent to Microsoft. The data is geared toward developers, so you might find that the details are a bit elusive. You can’t make sense of many of the items being tracked unless you understand the details of the operating system. However, it’s a good sign of good faith going forward that these items are now being exposed and can the examined by third-party reviewers to help us all understand what is being tracked and sent to Microsoft.

win 10 privacy fig 2 Susan Bradley

With Diagnostic Data Viewer, you can select what data goes to Microsoft.

Of related interest is the online privacy center where you can log in and review what Microsoft is collecting online regarding your browsing history and Cortana use. Review this site to determine what is currently being captured from your systems. Once there you can also remove data that was sent to Microsoft.

Windows update notifications

Microsoft is making small changes to Windows update notifications so that it is much more obvious that an update is going to take place and reboot your system. It has also added settings to assist with installing. When your computer is on, Windows Update will keep an inactive computer from going to sleep for two hours when installing an update.

Windows update changes

Administrators get more group policy and registry adjustments to better throttle Windows update bandwidth in a network setting. New features are located under Administrative Templates > Windows Components > Delivery Optimization. These new controls allow you to adjust bandwidth used by foreground downloads.

The amount of bandwidth can now be limited for both Windows Update and Microsoft Store updates. Previously, you could only limit the download bandwidth. Now you can specify Maximum Foreground Download Bandwidth (percentage) or Maximum Background Download Bandwidth (percentage). The process of installing feature updates has been designed to be faster to allow your machine to get back to functional access after the feature update has been triggered.

Administrators have been given the ability to customize the roll-back window. Before it was a set at 10 days that the system kept your old version, now the administrator has dism commands to customize the number of days the system will keep the prior version.

The following commands can be used to customize the roll-back window:

DISM /Online /Initiate-OSUninstall

Initiates an OS uninstall to take the computer back to the previous installation of windows.

DISM /Online /Remove-OSUninstall

Removes the OS uninstall capability from the computer.

DISM /Online /Get-OSUninstallWindow

Displays the number of days after upgrade during which uninstall can be performed.

DISM /Online /Set-OSUninstallWindow

Sets the number of days after upgrade during which uninstall can be performed.

Windows Hello

Windows Hello is making significant investments in changes to password and password management. First, it supports FIDO 2.0 authentication for Azure AD-joined Windows 10 devices and has increased options and features for support for shared devices. Windows 10 S mode (more on this later) is taking passwords to the next level by placing the authentication process into your mobile device.

The Microsoft Authenticator app is available for Android and iPhone and can be the authentication software used to log in. It replaces the traditional password authentication process. The process to prompt you through setting up Windows Hello’s alternative password techniques is easier as well. You can now start the process from the main log-in screen and can choose Windows Hello Face, Fingerprint or PIN options.

Deployment and password options

Microsoft is encouraging original equipment manufacturers to use AutoPilot to deploy and provision computers in a secure fashion for enterprises. Surface, Lenovo, and Dell currently support AutoPilot, and in the coming months Microsoft expects support from more vendors including HP, Toshiba, Panasonic, and Fujitsu. Combined with Intune, AutoPilot ensures the machine is locked during the setup process and delivered to the end-user in a secure deployment fashion.

For standalone computers, Windows 10 1803 now allows setting up security questions to make it easier to reset a local account that has a forgotten password.

Windows Defender renamed to Windows Security

Microsoft has renamed and slightly redesigned Windows Defender and is now calling it Windows Security. Virus and threat, account protections, and firewall and network protections; app and browser control; device security; device performance; and health and family options are now subsets of the Security section. Controlled folder access, added in 1709, has moved to the Ransomware protection section.

Windows Security now shares status between Microsoft 365 services and interoperates with Windows Defender Advanced Threat Protection, Microsoft’s cloud-based forensic analysis tool. Windows Defender Exploit Guard includes virtualization (VBS) and Hypervisor-protected code integrity (HVCI). Windows Defender Application Guard has added support for Edge and now can be enabled on Windows Pro, and not just the previously supported Enterprise version. Application Guard has to be enabled using Intune, Group policy or Powershell in Enterprise, but it can be enabled for standalone computers.

Edge browser updates

The Edge browser now allows extensions when the browser is used in Private mode. In addition, Windows Defender Application Guard is now available for Edge and Internet Explorer for Pro versions with the new release of 1803. You can identify which sites are trusted and if a user surfs to an untrusted website through Microsoft Edge or Internet Explorer.

Microsoft Edge will open the site in an isolated Hyper-V-enabled container. This is separate from the host operating system. If the untrusted site is malicious, then the host PC is protected. The isolated container is then anonymous, so an attacker can't get to your employee's enterprise credentials. Enabling Application Guard requires hardware that supports virtualization. Then go into the Control Panel, Programs and Features and turn Features on. Click to install Windows Defender Application Guard feature. In 1803 this major protection is now included in the pro SKU and is no longer limited to the Enterprise version.

Ransomware protection

First introduced in 1709, Controlled Folder Access, which protects local folders most often attacked by ransomware, has been moved to its own location in the Windows Security section. If you subscribe to Office 365, additional ransomware protections and detections have been included. If you are a personal subscriber or Home subscriber, Ransomware Detection now notifies you when the OneDrive files have been encrypted.

Kiosk mode

Often in Enterprises, you want to deploy what is termed “kiosk mode.” The deployment will be a locked down browser with a minimum amount of application support. With the release of 1803, Intune is now the preferred methodology to deploy a Windows 10 system in kiosk mode. As noted by Microsoft, the Kiosk Browser can be deployed from the Microsoft Store. Once deployed, you can configure a start URL, allowed URLs, and enable/disable navigation buttons through the deployment.

Windows S mode

The biggest change, and largest potential security gain, is the introduction of Windows S mode. It has the potential for a lock-down deployment methodology similar to how mobile phones can only install appls from the mobile phone vendor’s store. Applications are Microsoft-verified for security and performance and can only be deployed from the Microsoft store.

Security baseline draft released

Finally, Microsoft has released a draft of the recommended Security baseline. The differences between the draft for 1803 and the released baseline for 1709 include:

1 2 3 4 Page 2
Page 2 of 4
Shop Tech Products at Amazon