- Welcome to Microsoft Mechanics.
Coming up, we'll give you a hands on tour of
security, compatibility and manageability
of the new Microsoft Edge browser.
Now, the new Microsoft Edge is based on Chromium
and designed to be the best browser for business.
And if you missed our previous shows
on large-scale Edge deployment
and the integrated search experience with Microsoft Search,
you can check those out at aka.ms/EdgeForIT.
Let's start with security and what sets Edge apart
from other browsers.
Now, security is at the foundation of Edge
and the msedge.exe process itself.
Which is important because so much malware comes in
from the internet by the browser.
Now this is best shown by using Process Explorer.
And behind it, I have both Edge and Internet Explorer
open to the same three websites.
If you look at the integrity column
of the msedge.exe processes here,
these are all frames of the open pages,
and they're running at the lowest possible
level of integrity, which is called Untrusted
with zero privilege.
Now this means it can't even write
to your local file system.
Now, if we turn our attention over to the IE processes
there are three.
So, we can emulate the integrity level
by running notepad.exe with psexec
in low integrity mode.
We'll do that by using the L switch.
And that will open up Notepad.
So, I'll go ahead and type test,
then I'll save it to my Documents folder.
And just to prove it,
I'm going to navigate to my local disk and documents folder
in my user profile.
Now, I'll give it a name, I'll call it low,
and I won't save in fact, Windows recommends
to save it to the location where I currently am.
That means that those untrusted processes
that we saw in Edge,
they can't write to our local disk either.
Now, process isolation is critical here
for both security as well as reliability.
So, let me open up Process Explorer again.
And as you can see, each of the tabs within msedge.exe
are isolated as well as any of the child components
on the pages themselves.
So, I'll minimize Process Explorer
and go to the MSN tab in my Edge browser.
And if an ad is running on that page,
it's not going to have access to other content
on the same page.
I'm going to right click on the tab area of Edge
and then open up the browser Task Manager.
And we'll see the processes that are running in the browser.
So, I'm going to enter a few processes here
and you'll see the frowny face I-frame appear.
And because the processes
are completely isolated from each other,
they can't talk to each other
or affect the stability of the rest of the page.
Now, if we go back into the Process Explorer,
we'll see a result of killing all these processes
in the browser Task Manager.
You'll see here that only half of the processes
that we saw earlier are still running.
Now I'll refresh the page now
and we'll go back to Process Explorer
and we'll see all those processes come back.
Now one more thing I'll point out in Process Explorer:
by going to view, then show lower pane
we'll see that Edge also runs in an alternate desktop.
Now what this does is it provides an additional boundary
for window messages so it can break out
and talk to other process windows.
Now in addition to the secure foundation,
Edge can help protect your network and devices
from malicious attacks and prevent
unauthorized access and leaks of corporate data.
So, Microsoft Defender SmartScreen
provides an early warning system against known websites
that might engage in phishing attacks
or attempt to distribute malware through a focused attack.
Now Microsoft maintains a massive site reputation list
to protect your browsing.
So here I'm in a simulator site for Microsoft Defender,
and I want to show you a few more protections.
So first, I'm going to click on a phishing page link.
And we'll see that SmartScreen blocks the site
and also flags us that it's unsafe.
And here and I can get more information that
this is a known phishing site and all the dangers.
So, I'll close this tab.
And the next thing I want to show you is a malware page.
Now, we'll see the same type of block, same user message,
along with more information about malware and the risks.
I'll close this.
So now I'll click into the suspected phishing page
where I can actually provide input,
report the page as safe or unsafe.
And if I click that button
it gives me a few options.
And if I submit the form,
it's actually going to protect future visitors to the site.
Next, I'll try a potentially unwanted download.
So this protects against potentially unwanted apps, or PUAs.
Now, here we'll see that
we're trying to download freevideo.exe
and Edge is blocking it.
Now I can take the recommended path, delete it,
but if I trust that I can also choose to keep it.
In this case,
I'm going to use the recommendation and delete it.
Finally, I'll show you an outright blocked download.
And even though both attempts tried to block freevideo.exe,
the block downloads URL has an even lower reputation,
so it was presented as a block.
To stay in with the theme of isolation,
I want to show you something unique to Windows 10,
called Microsoft Defender Application Guard.
Now, this takes process isolation to another level
by opening the browser process
in a Hyper-V Krypton container,
and it runs completely outside of Windows.
So let me show you how that works.
So I have another window of Edge open here,
and I can click on the shield icon,
we'll see that this is running an application guard.
We can see evidence of this also in the taskbar
by these little shield glyphs
on top of both Edge and File Explorer.
And I'm in a malware research page
that hosts live malware packages,
and I want to download the first one.
I've already got the downloads folder open, in this case,
so you'll see our zip file.
But I want to show you a couple other things.
I'm on a Surface Book here,
it's got a one terabyte drive,
and you'll see that this environment is isolated
with about 40 gigabytes of storage.
And when I click into the C-drive,
you'll see this isn't the Windows file system
that you know from the root of C.
So now I'm going to open up the zip that we just downloaded,
and we'll see it's blocked.
And even if this was a zero day and executed,
all the damage would be contained within the container,
completely isolated from Windows.
And once I log out, it's gone
and will reset the rest of the Windows container as well.
One thing to note is that we have limited broker processes
that enable user interaction like we just saw,
as well as telemetry like Microsoft Defender ATP,
so we can monitor activities and alert your sec ops teams
if anything malicious happens
in the context of Application Guard.
Now, the last thing I want to show you for Edge security
are the controls and policies that you can set
from Microsoft Endpoint Manager.
Here you can also use security baselines for Edge.
And this will configure the recommended set of controls,
including the ones I just mentioned,
as well as many others.
Now, this is designed for high-security configurations.
And you can use these as your starting point,
then tailor controls to your specific needs.
Okay, so that was security.
But let's switch gears to compatibility.
Microsoft Edge is built to be compatible
with both the modern and legacy web.
Now, Internet Explorer mode ensures that
you can use legacy functionality, like document modes,
ActiveX, browser helper objects,
and IE settings and group policies that affect
security zones in protected mode.
Let me show you the experience when navigating
to a site that you've defined to open in the context of IE.
So here's the IE five homepage from the year 2000.
With Edge using Enterprise Mode,
you'll see that we can render
Internet Explorer-dependent pages
in the same browser instance.
Just the IE icon here indicates that we're using IE mode.
But as you saw, it doesn't launch a second window anymore.
And the user doesn't really need to know that
the site is rendering using Internet Explorer.
And it works the other way around too.
So, you can actively prevent people from using IE.
So here, I'm going to go ahead and copy that same URL.
I'll switch to another desktop with Internet Explorer
that's already open.
I'll open a new tab, paste in the URL,
and you'll see it pushes me back to the new Edge browser.
So next, I want to show you
how to configure this for your sites.
So now chances are,
you already have an Enterprise Mode Site List.
And if you did this after 2015 using the version two schema,
you might not need to do anything for your IE mode sites
to open in the context of Edge.
So now let's look at how you can configure Enterprise Mode
to determine how and where sites will be rendered.
To do that, I'll use Enterprise Mode Site List manager.
And that lets you add individually URLs and paths
to specify whether they render using Enterprise Mode or not.
So first, you'll start by downloading
and installing the Enterprise Mode Site List manager,
you can get that at aka.ms/EMSLM.
And you'll see it runs on Windows clients and servers
that are running Windows 7 and newer.
Now I'll switch to show you how sites are added.
So you'll add sites that you want to target
with Enterprise Mode.
And I already have web.archive.org here configured,
but I'll show you how to add another site with the tool.
So I'll click Add.
Now you'll paste in the URL or path
that you want to render inside of IE mode.
And you don't need to include the HTTP
or HTTPS designations here.
The open inbox then specifies the browser you want to use.
You can select IE11 to render in IE,
or MSEdge to render on Edge.
Now, if you choose none, and this is called a neutral site.
You'll usually want to add and configure some neutral sites
which will stay in the context
of the open and running browser,
whether that's Edge or IE.
In my case, I'll choose IE.
Next, the standalone IE checkbox says where it will open.
And the recommended setting here is to leave that unchecked,
so everything stays in the context of the Edge browser.
Otherwise it will spawn a second window of IE.
And if you check the allow redirect,
the redirected site will open
with the browser that's rendering specified
in the open end control.
In compat mode, you can choose the IE level
that you want to load the site in.
Now there are many options to choose from.
In most cases, you'll use the default mode.
Now I'll click Save.
And this tool is going to generate an XML file
that's used by policy controls.
So I want to save the XML, in my case
I'll go ahead and overwrite one that I previously built.
And now with the XML finished,
we need to save it to somewhere safe
that user PCs can reach and configure group policy
to enable Enterprise Mode for the sites
that we just defined in our list.
Now, to enable Enterprise Mode and Group Policy,
there are two options.
One in the IE node and one in the Edge node.
Now, the IE method is preferred; in most cases
it is just one setting to configure.
I'll show you how.
So, here I'll open up gpedit.msc.
I'll stretch the window a little bit
to make everything viewable.
We'll go to Administrative Templates,
Windows components, Internet Explorer,
and then use Enterprise Mode IE website list.
I'll select enabled.
In options we'll need to define where the XML is located.
And this can be an HTTPS, network, UNC
or local file location.
And all of your managed devices
will need to be able to reach this location
in the context of the device.
Now the most common option here
is to use a network location.
But if a substantial number of users are working remotely,
you'll need to ensure they can connect to it via VPN.
You can also use an intranet location as HTTPS,
but most organizations
won't be publishing this to a public location.
Now the next preferred option is to use a local path
and deliver the XML as a package and save locally
using software distribution tools
like Configuration Manager.
And here's a pro tip:
pay attention to your back slashes here.
You can't just paste in the path,
you need to edit it and make sure that you double these up,
so they can find that file.
Now finally, we'll click Apply and OK,
and the policy is set and we'll run gpupdate/force,
and now the policy is enforced.
So now if I open up Edge policies,
as you can see there are two settings
in the Microsoft Edge node route
to enable the integration that's set to one
and also to point to our site list.
Now if you configured Enterprise Mode policies
in the Edge node, and GPO,
the settings from the Edge node
are going to win in case of policy conflicts.
Edge node policies are recommended for
piloting policy updates
because they're going to override
existing policies that you set in the IE node.
So, let's try it out.
So, I'm going ahead and type in web archive.org,
The other site that was in our site list,
and it opens up in IE mode.
Now one more note for compatibility.
If you're currently defaulting all of your traffic,
or all internal internet traffic to IE,
there are tools to help target the sites
that actually need Enterprise Mode.
So you can start using modern rendering
for everything else and take advantage
of those security benefits that I mentioned earlier.
And once you have Edge deployed with your security
and compat settings configured,
it's time to consider your update management
or servicing options for Microsoft Edge.
Now, if you saw our Edge deployment episode,
I demonstrated a new control
as of Configuration Manager 2002,
that adds a checkbox as part of the package creation process
allowing Edge to automatically update itself
when updates are ready.
So, to do this in Configuration Manager,
when you build the package,
you choose your release channel,
latest or specific version,
and our automatic update setting that you see here.
Now, automatic updates are the most common option
that IT admins use
when managing other common Chromium-based browsers
like Google Chrome, and it's the recommended setting.
That said, there are several controls
for managing updates manually.
And in Configuration Manager
you can also use
the standard update approval process and flow.
Additionally, there are new ADMX-based policies
with new options.
First to get the policy templates,
you head over to aka.ms/edgeenterprise
and choose get policy files
to download the ADMX files that you need.
So you can now use policies to limit update build levels
to specific target versions in Edge,
as long as they're build 83 and newer
using the Edge target version override policy
found in Administrative Templates,
Microsoft Edge updates, applications, Microsoft Edge.
Now with this control enabled,
you can set the version of the build number
that you validated,
then change the target version using this policy
as you validate and approve newer builds.
In the future,
You could continue updating that version number via policy
and do that centrally as future Edge updates
are validated and approved.
As part of validation,
one last policy I want to show you
is in Administrative Templates,
Windows components Internet Explorer.
It's called configure which channel of Microsoft Edge
to use for opening redirected sights.
Now, as an internal developer,
or maybe as a pilot user,
you can test new releases and you can set channel priority.
So you can see here there's a first choice,
second choice and third choice.
And if these channels aren't present on a system,
it will continue working down that list
until it finds one of those choices.
And with Edge channels for stable Beta, Dev, and Canary,
you can run those versions side by side.
Now side-by-side installation is recommended for testing
and validating capabilities early on while managing risk.
And remember that both stable
as well as beta channels of Edge
are both fully supported by Microsoft.
That was a review of the technology
of underlying controls for Edge security,
compatibility and update management.
Check out our full playlist for Microsoft Edge,
at aka.ms/EdgeforIT for more information.
And if you haven't already, subscribe to Microsoft Mechanics
for the latest tech updates.
Thanks for watching, we'll see you next time.
(bright orchestral music)