Windows 10: Security baseline for Office 365 ProPlus (v1907, July 2019) - DRAFT

Brink · Jul 24, 2019

Microsoft is pleased to announce the draft release of the recommended security configuration baseline settings for Microsoft Office 365 ProPlus, version 1907. Please evaluate this proposed baseline and send us your feedback through the Baselines Discussion site.

This baseline builds on the overhauled Office baseline we released in early 2018. The highlights of this baseline include:

Componentization of GPOs so that “challenging” settings can be added or removed as a unit.

Comprehensive blocking of legacy file formats

Blocking Excel from using Dynamic Data Exchange (DDE)

Also see the announcements at the end of this post regarding the new Security Policy Advisor and Office cloud policy services.

The downloadable attachment to this blog post includes importable GPOs, a script to apply the GPOs to local policy, a custom administrative template (ADMX) file for Group Policy settings, all the recommended settings in spreadsheet form and as Policy Analyzer rules. The recommended settings correspond with the Office 365 ProPlus administrative templates version 4888 released on July 17, 2019 that can be downloaded here. The download for the final version of this baseline will be released through the Security Compliance Toolkit.

Componentization of GPOs
Most organizations can implement most of the baseline’s recommended settings without any problems. However, there are a few settings that will cause operational issues for some organizations. We have broken out related groups of such settings into their own GPOs to make it easier for organizations to add or remove these restrictions as a set. The local-policy script, BaselineLocalInstall.ps1, offers command-line options to control whether these GPOs are installed.

The “MSFT Office 365 ProPlus 1907” GPO set includes “Computer” and “User” GPOs that represent the “core” settings that should be trouble free, and each of these potentially challenging GPOs, each of which is described later:

“Legacy File Block – User” is a User Configuration GPO that prevents Office applications from loading or saving legacy file formats.

“Require Macro Signing – User” is a User Configuration GPO that disables unsigned macros in each of the Office applications.

“Excel DDE Block – User” is a User Configuration GPO that blocks Excel from using DDE to search for existing DDE server processes or to start new ones.

Comprehensive blocking of legacy file formats
In the previous Office baseline we published, we tried to end the use of legacy file formats, including all the old Office document formats such as *.doc, *.xls, and *.ppt. However, we missed some important ones. So we just went ahead and fixed the glitch.

One of the threats of these old binary file formats is that their inherent complexity too often led to exploitable bugs in their parsers. The bigger threat is that many of these formats can include macros or other executable instructions that are easily abused. By contrast, macros are disabled with the most-commonly used Office Open XML (OOXML) document formats, which were first introduced with Office 2007. Only macro-enabled formats such as *.docm and *.xlsm support macros, and these can be filtered at the point of ingress.

While fixing the glitch, however, we also recognized that many organizations cannot entirely end their use of legacy Office document formats, so we broke out the file-blocking settings into a separate GPO, so they can be added or removed as a cohesive unit.

Blocking Excel from using DDE
Dynamic Data Exchange (DDE) is a very old interprocess communication method that is still used in some parts of Windows and remains supported for applications to use, primarily for backward compatibility. A few years ago, malware authors began embedding specially-formed DDE references in Office documents that were sent to victims and that would run attacker-chosen code. Since then, most Office apps quietly disabled the use of DDE. Excel retained user-configurable settings to enable DDE server process lookup and launch. These can now be configured through Group Policy, and this baseline recommends disabling both settings. Because of the likelihood that some organizations still depend on this functionality, we have broken out “Excel DDE Block” as a separate GPO.

Macro signing
The baseline also retains the “VBA Macro Notification Settings” options from our previous baselines that require that macros embedded in Office documents be signed by a trusted publisher. We recognize that some organizations have had workflows and processes relying on such macros for a long time, and that enforcing these particular settings can cause operational issues. It can also be challenging to identify all the documents and VBA projects that need to be signed. We have decided at this time to move these settings into a separate GPO to make it easier to switch the settings on or off without affecting the rest of the baseline.

Note that the “Block macros from running in Office files from the Internet” settings we turned on in the previous baseline are retained in the main GPOs and should be enforced by all security-conscious organizations.

Also see below about how the new Security Policy Advisor service can provide tailored recommendations for VBA macro policies.

Other changes in the baseline

“Block macros from running in Office files from the Internet” is now supported for Access, so we added it.

Implemented new settings to block the opening of certain untrusted files and to open others in Protected View.

Enabled the new “Macro Runtime Scan Scope” setting.

Removed the file block setting for “PowerPoint beta converters,” as Office no longer implements that block.

Deploy policies from the cloud, and get tailored recommendations for specific security policies
In addition to being able deploy these policies through Active Directory Group Policy or through Local Group Policy, you now have a new way to deploy user-based policies from the cloud to any Office 355 ProPlus client through the new Office cloud policy service.

The Office cloud policy service allows administrators to define policies for Office 365 ProPlus and assign these policies to users via Azure Active Directory security groups. Once defined, policies are automatically enforced as users sign in and use Office 365 ProPlus. No need to be domain joined or MDM enrolled, and it works with corporate-owned devices or BYOD. To learn more about Office cloud policy service, check out the announcement here: The new cloud-based policy management service for Office 365 ProPlus has been released!.

We also have a new service in public preview called Security Policy Advisor that can help you with deploying security policies. Security Policy Advisor can provide you with tailored recommendations for specific security policies based on how Office is used in your enterprise. For example, in most customer environments, macros are typically used in specific apps such as Excel and only by specific groups of users. Security Policy Advisor can help you identify groups of users and applications where macros can be disabled with minimal productivity impact, and optionally integrate with Office 365 Advanced Threat Protection to provide you information on who is being attacked. To learn more about Security Policy Advisor, check out the announcement here: Announcing Security Policy Advisor Preview for Office 365 ProPlus - Microsoft Tech Community - 480880.

Click to expand...

Source: https://techcommunity.microsoft.com/...FT/ba-p/771308

:)

Brink · Jul 24, 2019

Office 365 ProPlus updates

Office 365 ProPlus delivers cloud-connected and always up-to-date versions of our most valuable enterprise apps. Today, we’re making three important announcements related to ProPlus: changes to the Office 365 system requirements; improvements to the ProPlus update model, including alignment with Windows 10; and new tools and programs to manage ProPlus application compatibility.

Changes to the Office 365 system requirements

Office 365 ProPlus is the very best way to experience the Office 365 services. For IT, ProPlus delivers the most secure and most complete suite of productivity apps available. And because the apps are cloud-connected and always up-to-date, they’re continually getting better—with new security features, new telemetry and new management capabilities. For end users, ProPlus brings the Office 365 services to life. When a modern app is connected to a modern service, magic happens. People can collaborate in new ways. Apps can simplify mundane tasks. And advanced security services can protect users as they work.

When customers connect to Office 365 with a legacy version of Office, they’re not enjoying all that the service has to offer. The IT benefits—particularly security—are cut short. And the end user experience in the apps is limited to the features shipped at a point in time. To ensure that customers are getting the most out of their Office 365 subscription, we are updating our system requirements.

Office 365 ProPlus or Office perpetual in mainstream support required to connect to Office 365 services. Starting October 13, 2020, Office 365 ProPlus or Office perpetual in mainstream support will be required to connect to Office 365 services. Office 365 ProPlus will deliver the best experience, but for customers who aren’t ready to move to the cloud by 2020, we will also support connections from Office perpetual in mainstream support.

Applies to Office 365 commercial services only. This update does not change our system requirements or support policies for the Office perpetual clients, Office perpetual clients connecting to on-premises servers, or any consumer services.

More than three years’ notice. We’re providing more than three years’ notice to give IT time to plan and budget for this change. Until this new requirement goes into effect in 2020, Office 2010, Office 2013 and Office 2016 perpetual clients will still be able to connect to Office 365 services.

Visit our Office 365 Tech Community to learn more and to ask the experts your questions.

Improvements to the Office 365 ProPlus update model, including alignment with Windows 10

Moving to Office 365 ProPlus requires an initial upgrade and ongoing management of regular updates. Customers quickly see the benefits of the move, but they’ve also asked us to simplify the update process—and to improve the coordination between Office and Windows. To respond to this feedback, we’re pleased to announce that we will align the Office 365 ProPlus and Windows 10 update model. This change will make planning and managing updates for both Office and Windows easier for customers using the Secure Productive Enterprise.

Targeting September 2017, we will make the following changes to the Office 365 ProPlus update model:

Two updates a year. We will reduce the Office 365 ProPlus update cadence from three to two times a year, with semi-annual feature updates to Windows 10 and Office 365 ProPlus targeted for March and September.

18 months of support. We will extend the support period for Office 365 ProPlus semi-annual updates from 12 to 18 months (starting from first release) so IT professionals can choose to update once or twice a year.

System Center Configuration Manager support. System Center Configuration Manager will support this new aligned update model for Office 365 ProPlus and Windows 10, making it easier to deploy and update the two products together.

See the upcoming changes to the Office 365 ProPlus update management article to learn more.

New tools and programs to manage Office 365 ProPlus application compatibility

One of the biggest concerns customers have about the move to a new version of Office is application compatibility. Office add-ins and VBA solutions often play a significant role in key business processes, and application compatibility is an important consideration in both upgrades and updates. To help customers manage ProPlus application compatibility, we’re pleased to announce four new investments.

Upgrade assessment tools. Starting today, we’re offering a limited preview of new tools that will catalogue the add-ins and VBA solutions in use in your organization, identify potential issues with the upgrade to Office 365 ProPlus, and recommend steps for remediation.

Application compatibility testing. For each new Office 365 ProPlus release, we will perform compatibility testing of the most common third-party add-ins, identify potential issues, and take steps to remediate.

Office 365 ProPlus monitoring services. We will provide new services to monitor your ProPlus deployment and provide visibility into the usage and stability of apps and add-ins.

Reporting, tracking and resolving issues. We will improve our existing service for reporting, tracking and resolving application compatibility issues—and partner with customers and ISVs to find the best approach to remediation.

You can learn more about the upgrade assessment tools today, and we’ll have more to share on our application compatibility testing program, the new Office 365 ProPlus monitoring services and the new service for reporting, tracking and resolving issues in the coming months.

We are here to help

If you’re connecting to Office 365 with a legacy version of Office, you’re not enjoying all that the service has to offer—and we’re here to help. For more information on Office 365 ProPlus deployment, refer to the Office 365 ProPlus Deployment Guide and the ProPlus Ignite On-Demand sessions. And when you’re ready to make the move to ProPlus, the Microsoft FastTrack customer success service will help you with the details. Visit the FastTrack website to learn more and submit a request for help with planning, assessment and deployment. ProPlus is the very best way to experience the Office 365 services, and we’re committed to helping you upgrade with confidence.

—Ron Markezich
Click to expand...

Source: Office 365 ProPlus updates - Office Blogs

Brink · Jul 24, 2019

Security baseline (DRAFT) for Windows 10 v1809 and Windows Server 2019

Microsoft is pleased to announce the draft release of the security configuration baseline settings for Windows 10 version 1809 (a.k.a., “Redstone 5” or “RS5”), and for Windows Server 2019. Please evaluate these proposed baselines and send us your feedback via blog comments below.

Download the content here: Windows-10-1809-Security-Baseline-DRAFT.zip

The downloadable attachment to this blog post includes importable GPOs, a PowerShell script for applying the GPOs to local policy, custom ADMX files for Group Policy settings, documentation in spreadsheet form and as a Policy Analyzer file (MSFT-Win10-v1809-RS5-WS2019-DRAFT.PolicyRules). In this release, we have changed the documentation layout in a few ways:

MS Security Baseline Windows 10 v1809 and Server 2019.xlsx – multi-tabbed workbook listing all Group Policy settings that ship in-box with Windows 10 v1809 or Windows Server 2019. Columns for “Windows 10 v1809,” “WS2019 Member Server,” and “WS2019 DC” show the recommended settings for those three scenarios. A small number of cells are color-coded to indicate that the settings should not be applied to systems that are not joined to an Active Directory domain. Cells in the “WS2019 DC” columns are also highlighted when they differ from the corresponding cells in the “WS2019 Member Server” column. Another change from past spreadsheets is that we have combined tabs that used to be separate. Specifically, we are no longer breaking out Internet Explorer and Windows Defender AV settings into separate tabs, nor the settings for LAPS, MS Security Guide, and MSS (Legacy). All these settings are now in the Computer and User tabs.

BaselineDiffs-to-v1809-RS5-DRAFT.xlsx – This Policy Analyzer-generated workbook lists the differences in Microsoft security configuration baselines between the new baselines and the corresponding previous baselines. The Windows 10 v1809 settings are compared against those for Windows 10 v1803, and the Windows Server 2019 baselines are compared against those for Windows Server 2016.

Windows 10 1803 to 1809 New Settings.xlsx – Lists all the settings that are available in Windows 10 v1809 that were added since Windows 10 v1803. (We used to highlight these settings in the big all-settings spreadsheets.)

Server 2016 to 2019 New Settings.xlsx – Lists all the settings that are available in Windows Server 2019 that were added since Windows Server 2016. (We used to highlight these settings in the big all-settings spreadsheets.)

Highlights of the differences from past baselines, which are listed in BaselineDiffs-to-v1809-RS5-DRAFT.xlsx:

The MS Security Guide custom setting protecting against potentially unwanted applications (PUA) has been deprecated, and is now implemented with a new setting under Computer Configuration\...\Windows Defender Antivirus.

We have enabled the “Encryption Oracle Remediation” setting we had considered for v1803. At the time we were concerned that enabling the newly-introduced setting would break too many not-yet-patched systems. We assume that systems have since been brought up to date. (You can read information about the setting here and here.)

Changes to Virtualization-Based Security settings (used by Credential Guard and Code Integrity):

“Platform Security Level” changed from “Secure Boot and DMA Protection” to “Secure Boot.” If system hardware doesn’t support DMA protection, selecting “Secure Boot and DMA Protection” prevents Credential Guard from operating. If you can affirm that your systems support the DMA protection feature, choose the stronger option. We have opted for “Secure Boot” (only) in the baseline to reduce the likelihood that Credential Guard fails to run.

Enabled the new System Guard Secure Launch setting which will enable Secure Launch on new capable hardware. Secure Launch changes the way windows boots to use Intel Trusted Execution Technology (TXT) and Runtime BIOS Resilience features to prevent firmware exploits from being able to impact the security of the Windows Virtualization Based Security environment.

Enabled the “Require UEFI Memory Attributes Table” option.

Enabled the new Kernel DMA Protection feature described here. The “External device enumeration” policy controls whether to enumerate external devices that are not compatible with DMA-remapping. Devices that are compatible with DMA-remapping are always enumerated.

Removed the BitLocker setting, “Allow Secure Boot for integrity validation,” as it merely enforced a default that was unlikely to be modified even by a misguided administrator.

Removed the BitLocker setting, “Configure minimum PIN length for startup,” as new hardware features reduce the need for a startup PIN, and the setting increased Windows’ minimum by only one character.

Enabled the new Microsoft Edge setting to prevent users from bypassing certificate error messages, bringing Edge in line with a similar setting for Internet Explorer.

Removed the block against handling PKU2U authentication requests, as the feature is increasingly necessary.

Removed the configuration of the “Create symbolic links” user rights assignment, as it merely enforced a default, was unlikely to be modified by a misguided administrator or for malicious purposes, and needs to be changed to a different value when Hyper-V is enabled.

Removed the deny-logon restrictions against the Guests group as unnecessary: by default, the Guest account is the only member of the Guests group, and the Guest account is disabled. Only an administrator can enable the Guest account or add members to the Guests group.

Removed the disabling of the xbgm (“Xbox Game Monitoring”) service, as it is not present in Windows 10 v1809. (By the way, consumer services such as the Xbox services have been removed from Windows Server 2019 with Desktop Experience!)

Removed Credential Guard from the Domain Controller baseline. (Credential Guard is not useful on domain controllers and is not supported there.)

Created and enabled a new custom MS Security Guide setting for the domain controller baseline, “Extended Protection for LDAP Authentication (Domain Controllers only),” which configures the LdapEnforceChannelBinding registry value described here.

The Server 2019 baselines pick up all the changes accumulated in the four Windows 10 releases since Windows Server 2016.

We have replaced the collection of .cmd batch files for applying the baselines to local policy with a single PowerShell script that takes one of these five command-line switches to indicate which baseline you want to apply:.\BaselineLocalInstall.ps1 -Win10DomainJoined - for Windows 10 v1809, domain-joined
.\BaselineLocalInstall.ps1 -Win10NonDomainJoined - for Windows 10 v1809, non-domain-joined
.\BaselineLocalInstall.ps1 -WS2019Member - for Windows Server 2019, domain-joined
.\BaselineLocalInstall.ps1 -WS2019NonDomainJoined - for Windows Server 2019, non-domain-joined
.\BaselineLocalInstall.ps1 -WS2019DomainController - for Windows Server 2019, domain controller
A couple of important notes about using the BaselineLocalInstall.ps1 script:

PowerShell execution policy must be configured to allow script execution. You can configure this with a command line such as the following:
Set-ExecutionPolicy RemoteSigned

LGPO.exe must be in the Tools subdirectory or somewhere in the Path. LGPO.exe is part of the Security Compliance Toolkit and can be downloaded from this URL:
https://www.microsoft.com/download/d....aspx?id=55319

Windows 10 v1809 has greatly expanded its manageability using Mobile Device Management (MDM). The Intune team is preparing documentation about the Microsoft Windows MDM security baseline and how to use Intune to implement the baseline, and will publish it very soon. We will post information to this blog when that happens.
Click to expand...

Source: Security baseline (DRAFT) for Windows 10 v1809 and Windows Server 2019 Microsoft Security Guidance blog

Download: Windows-10-1809-Security-Baseline-DRAFT.zip

Brink · Jul 24, 2019

Office 365 Monthly Channel v1906 build 11727.20244 - July 9

Version 1906: July 09

Version 1906 (Build 11727.20244)

Security updates listed here

Outlook: Non-security updates

Addresses an issue that caused current folder search to intermittently fail.

Click to expand...

Source:

https://docs.microsoft.com/en-us/off...y-channel-2019

What's new in Office 365 - Office Support

Tip Latest Office Updates for Windows

How to Check for Updates in Office 2016 and Office 2019 for Windows

Windows 10: Security baseline for Office 365 ProPlus (v1907, July 2019) - DRAFT

Security baseline for Office 365 ProPlus (v1907, July 2019) - DRAFT

Security baseline for Office 365 ProPlus (v1907, July 2019) - DRAFT

Security baseline for Office 365 ProPlus (v1907, July 2019) - DRAFT

Security baseline for Office 365 ProPlus (v1907, July 2019) - DRAFT - Similar Threads - Security baseline Office

Security baseline for Office 365 ProPlus (v2103, March 2021) - DRAFT

Security baseline (DRAFT) for Windows 10 and Windows Server v2004

Office 365 ProPlus questions

Windows Server 2019 adds support for Office 365 ProPlus Office

Office 365 Monthly Channel v1907 build 11901.20176 - July 29

Security baseline DRAFT for Windows 10 and Windows Server 2019 v1903

Save AutoRecover doesn't work in Office 365 ProPlus

Security baseline (DRAFT) for Windows 10 v1809 and Windows Server 2019

Office 365 ProPlus updates

Users found this page by searching for:

security baseline for office 365 proplus (v1907 sept 2019) - final

office 365 business premium security baseline

download security baseline o365