Defender Advanced Threat Protection for Server 2019
Defender Advanced Threat Protection for Server 2019
About the Book
Are you ready to start deploying Windows Server 2019? If so, you must read this book as the built-in Windows Defender Anti-Virus is not enough for protection. It is like downloading a free version of Anti-Virus and running it on your servers. With Microsoft Defender Advanced Threat Protection you get all of the robust features you would expect out of an enterprise Anti-Virus / Malware / and Security Product. These do not come pre-installed and require configuration via securitycenter.microsoft.com. This book will walk you through how to setup, configure, and test Defender Advanced Threat Protection.
Bundles that include this book
Table of Contents
Foreword by iii
Acknowledgments iii
From Dave iii
About the Authors iv
Dave Kawula – Microsoft MVP iv
Cristal Kawula – Microsoft MVP v
Emile Cabot – Microsoft MVP vi
Cary Sun – Microsoft MVP vii
John O’Neill Sr – Re-Connect Microsoft MVP viii
Contents ix
Introduction 14
MVPDays Online 14
Sample Files 15
Additional Resources 15
Chapter 1 17
Setting up your Azure Subscription from Scratch 17
Chapter 2 24
Building a Hyper-V Nested VM with Multiple Public IP Addresses in Azure 24
Building a Windows Server 2016 Virtual Machine 24
Creating Multiple Internal and External IP’s for the Lab 35
Enable Hyper-V in the LAB Virtual Machine 42
Configuring NAT Networking with one Public IP Address 50
Configuring NAT Networking with Multiple Public IP Address 53
Adding an IP Address to the lab Host (VM) 53
Configuring Routing and Remote Access on the Azure Nested Virtual Machine 57
Configure NAT Rules in RRAS for the Lab 65
Disable Windows Firewall 72
Create a NAT Rule in the Azure NSG for the Lab 74
Testing the NAT Rules in the lab 80
Using PowerShell to automate RRAS NAT Rule Configurations 85
Chapter 3 88
Using BigDemo to Build your Lab 88
Lab Server Names 88
Building the Lab with BigDemo_DefenderATP_Server2019.PS1 91
Chapter 4 95
Configuring Windows Admin Center 95
Install Google Chrome and Mozilla FireFox 96
Configure Windows Admin Center 97
Configure Azure Integration 99
Configure Azure Backup 104
Verifying Backups locally with the Backup Microsoft Azure Backup Agent 110
Configuring Windows Azure Update Management 112
Configure Azure Site Recovery 119
Upgrade to Security Center Standard in Azure 125
Chapter 5 127
Defender Advanced Threat Protection ATP 127
Onboarding a Server with Windows Defender ATP 128
Reviewing an Incident with Windows Defender Advanced Threat Protection 130
Chapter 6 133
Simulating a Ransomware Attack 133
KnowBe4 Ransomware Simulator on Windows Server 2019 133
Enabling Ransomware Protection on Windows Server 2019 141
Executing a Ransomware Attack with PowerShell 145
Chapter 7 152
Attack Simulation – Document Drops Back Door 152
Attempting the Attack with Defender Enabled 153
Chapter 8 165
Attack Simulation – PowerShell Fileless Attack 165
Attempting the Attack with Defender Enabled and Exploit Protection at Default Settings 166
Configure Exploit Protection 170
Attempting the Attack with Defender Enabled and Exploit Protection configured for Notepad.exe 171
Chapter 9 176
Attack Simulation – Live Response 176
Enabling Live Response in Defender Security Center 177
Chapter 10 179
Attack Remediation – Chat with Threat Experts at Microsoft 179
Contacting Microsoft Threat Experts 179
Chapter 11 182
Recovering from Ransomware using Azure Site Recovery 182
Notes from the Field 182
Why Airgapped Replicas are the only choice 182
Why Planned Failover is no longer an option 182
Failover Now is the only Option 183
Watch you Six (Clock) 183
Do not connect your Azure Site Recovery Virtual Machines to a live Site-to-Site VPN 184
When can I get back into my data? 184
Ok, so I didn’t listen and lost everything now what? 185
Don’t forget to tune your Replication Policy 186
Testing Failover can be a quick Ransomware Fix 186
Reset Settings for your Azure Site Recovery Hyper-V Host 187
Enable Diagnostic Logging for Azure Site Recovery 192
Zero Day time to Failover 193
Assuming an Admin Level breach Failing over 100 % to Azure 193
Executing a PowerShell based Ransomware Attack on Domain Controllers. 193
Encrypting the Sysvol Folder 195
Taking Down Production Killing Domain Controllers with Ransomware 201
Encrypting the Active Directory Database 201
Survival Mode Recovering to Azure 208
Tick Tock time to make a decision – We are Recovering to Azure 209
Performing the Double Swing Recovery 210
Chapter 12 219
Join us at MVPDays and meet great MVP’s like this in person 219
Live Presentations 219
Video Training 219
Live Instructor-led Classes 220
Consulting Services 220
Other books by these authors
Authors have earned$10,089,287writing, publishing and selling on Leanpub, earning 80% royalties while saving up to 25 million pounds of CO2 and up to 46,000 trees.
Learn more about writing on Leanpub
The Leanpub 45-day 100% Happiness Guarantee
Within 45 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers), EPUB (for phones and tablets) and MOBI (for Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.
Learn more about Leanpub's ebook formats and where to read them
Top Books
C++20
Rainer GrimmC++20 is the next big C++ standard after C++11. As C++11 did it, C++20 changes the way we program modern C++. This change is, in particular, due to the big four of C++20: ranges, coroutines, concepts, and modules.
The book is almost daily updated. These incremental updates ease my interaction with the proofreaders.
A Guide to Artificial Intelligence in Healthcare
Dr. Bertalan MeskoCan we stay human in the age of A.I.? To go even further, can we grow in humanity, can we shape a more humane, more equitable and sustainable healthcare? This e-book aims to prepare healthcare and medical professionals for the era of human-machine collaboration. Read our guide to understanding, anticipating and controlling artificial intelligence.
C++ Best Practices
Jason TurnerLevel up your C++, get the tools working for you, eliminate common problems, and move on to more exciting things!
Atomic Kotlin
Bruce Eckel and Svetlana IsakovaFor both beginning and experienced programmers! From the author of the multi-award-winning Thinking in C++ and Thinking in Java together with a member of the Kotlin language team comes a book that breaks the concepts into small, easy-to-digest "atoms," along with exercises supported by hints and solutions directly inside IntelliJ IDEA!
Sockets and Pipes
Type ClassesSockets and Pipes is not an introduction to Haskell; it is an introduction to writing software in Haskell. Using a handful of everyday Haskell libraries, this book walks through reading the HTTP specification and implementing it to create a web server.
Introducing EventStorming
Alberto BrandoliniThe deepest tutorial and explanation about EventStorming, straight from the inventor.
node-opcua by example
Etienne RossignonGet the best out of node-opcua through a set of documented examples by the author himself that will allow you to create stunning OPCUA Servers or Clients.
Ansible for DevOps
Jeff GeerlingAnsible is a simple, but powerful, server and configuration management tool. Learn to use Ansible effectively, whether you manage one server—or thousands.
Functional Design and Architecture
Alexander GraninSoftware Design in Functional Programming, Design Patterns and Practices, Methodologies and Application Architectures. How to build real software in Haskell with less efforts and low risks. The first complete source of knowledge.
Composing Software
Eric ElliottAll software design is composition: the act of breaking complex problems down into smaller problems and composing those solutions. Most developers have a limited understanding of compositional techniques. It's time for that to change.
Top Bundles
- #1
Software Architecture for Developers: Volumes 1 & 2 - Technical leadership and communication
2 Books
"Software Architecture for Developers" is a practical and pragmatic guide to modern, lightweight software architecture, specifically aimed at developers. You'll learn:The essence of software architecture.Why the software architecture role should include coding, coaching and collaboration.The things that you really need to think about before... - #2
All the Books of The Medical Futurist
6 Books
We put together the most popular books from The Medical Futurist to provide a clear picture about the major trends shaping the future of medicine and healthcare. Digital health technologies, artificial intelligence, the future of 20 medical specialties, big pharma, data privacy, digital health investments and how technology giants such as Amazon... - #3
PowerShell
3 Books
Buy every PowerShell book from Adam Bertram at a 20% discount! - #4
Cisco CCNA 200-301 Complet
4 Books
Ce lot comprend les quatre volumes du guide préparation à l'examen de certification Cisco CCNA 200-301. - #5
Linux Administration Complet
4 Books
Ce lot comprend les quatre volumes du Guide Linux Administration :Linux Administration, Volume 1, Administration fondamentale : Guide pratique de préparation aux examens de certification LPIC 1, Linux Essentials, RHCSA et LFCS. Administration fondamentale. Introduction à Linux. Le Shell. Traitement du texte. Arborescence de fichiers. Sécurité... - #6
Modern C++ by Nicolai Josuttis
2 Books
- #7
Django for Beginners/APIs/Professionals
3 Books
- #8
Learn Git, Bash, and Terraform the Hard Way
3 Books
Learn Git, Bash and Terraform using the Hard Way method.These technologies are essential tools in the DevOps armoury. These books walk you through their features and subtleties in a simple, gradual way that reinforces learning rather than baffling you with theory. - #9
Software Architecture and Beautiful APIs
2 Books
There is no better way to learn how to design good APIs than to look at many existing examples, complementing the Software Architecture theory on API design. - #10
Digital Future of Healthcare and Pharma
3 Books
These three popular e-books from The Medical Futurist describes how digital health technologies will shape the future of health, healthcare, medicine and pharma with exciting infographics in a digestible format.