Network protection

Timeline

From the capture of 12 Oct 23:53 UTC

2 relative periods
12 undated sections
15 with conditions

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

AllowDatagramProcessingOnWinServer
AllowNetworkProtectionDownLevel
EncryptedClientHello
EncryptedClientHelloEnabled
Multi-Session
New-NetFirewallRule
Non-Microsoft
Set-MpPreference

Relative periods

Counted from an event the source describes, such as installing an update; they are not calendar dates.

for 24 hoursWarn experienceMilestone
up to 30 daysAdvanced huntingMilestone1 condition

Requirements, exceptions and scope

Network protection coverageRequirementException1 condition4 passages
Non-Microsoft
Feature: Web Threat Protection; Microsoft Edge: SmartScreen must be enabled; Non-Microsoft browsers: Network protection must be in block mode; Nonbrowser processes (for example, PowerShell): Network…
Known issues & limitationsRequirementExceptionScope4 conditions5 passages
Requirements for network protectionRequirement2 conditions2 passages
Using network protectionRequirement1 condition2 passages
Advanced huntingScope2 passages
Required browser configurationRequirement1 condition1 passage
EncryptedClientHelloEnabledEncryptedClientHello
Review network protection events in Windows Event ViewerException1 condition1 passage
Network protection and the TCP three-way handshakeRecommendation1 passage
Network protection registry keysException1 condition1 passage
AllowNetworkProtectionDownLevel
Windows Servers and Windows Multi-session configuration requires PowerShellRequirement3 conditions3 passages
Multi-SessionSet-MpPreferenceAllowDatagramProcessingOnWinServer
Network protection troubleshootingRequirement1 passage
Disable QUIC in Windows FirewallScope1 passage
New-NetFirewallRule

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

Observed history and review priority

Captured 12 Oct 23:53 UTC; extracted 16 Oct 16:10 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c.

Review priority. Extracted assertions require review · Applicability or exceptions require review

0 date changes and 0 condition changes across 0 compared revisions. Suggested check interval: 24 hours.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Retained observations · 2

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

12 Oct 23:53 UTC · 27 candidates
8 Oct 23:13 UTC · 27 candidates