Microsoft Technology Licensing, LLC

Jeffrey A Sutherland

Michael Joseph Healy

Md Nazmus Sakib

Scott Randall Shell

Scott Daniel Anderson

Deskin M Miller

Jeffrey Richard McKune

Gaurav Raghu Dhawan

Kinshumann Kinshumann

Brett D A Flegg

Thomas W Caldwell

Hassen Karaa

David C James

Bruce Wayne Copeland

Dustin Michael Ingalls

Rajagopalan Badri Narayanan

Khuzaima Iqbal

Zhengkai Kenneth Pan

Jeffry B Phillips

Donald Y Song

Joseph S Calabig

Adrian Mihail Marinescu

Deepak Jagannathan Manohar

Jaskaran Singh Khurana

Thomas Walter Caldwell, Iii

Jessica M Krynitsky

Deven Robert Desai

Brett DA Flegg

Michael Healy

An application is installed on a computing device from an application package. An origin of the application (e.g., a managed installer for an enterprise, a reputation checking service) is propagated to files written to a storage device of the computing device as part of the installation, such as by writing origin information to the storage device as metadata associated with the file. The origin information for a file, in conjunction with a policy on the computing device specifying one or more trusted origins for applications on the computing device, is used to identify whether a particular action can be taken with and/or by the file. These actions can include, for example, execution of an application from an executable file. If the origin information for a file indicates an origin that is a trusted origin specified by the policy, then the action can be performed.

Propagating origin information for applications during application installation

Integrity verification of a containerized application using a block device signature is described. For example, a container deployed to a host system is signed with a single block device signature. The operating system of the host system implements an integrity policy to verify the integrity of the container when the container is loaded into memory and when its program code executes. During such events, the operating system verifies whether the block device signature is valid. If the block device signature is determined to be valid, the operating system enables the program code to successfully execute. Otherwise, the program code is prevented from being executed. By doing so, certain program code or processes that are not properly signed are prevented from executing, thereby protecting the host system from such processes. Moreover, by using a single block device signature for a container, the enforcement of the integrity policy is greatly simplified.

Block device signature-based integrity protection for containerized applications

Examples described herein generally relate to a computer device including a memory, and at least one processor configured to determine whether to allow execution of an application file on the computer device. The processor receives a command to execute a file. The processor determines whether the file is associated with a package reputation of an installation package. The processor determines a file reputation of the file. The processor determines whether to allow execution of the file based on a combination of the file reputation of the file and whether the file is associated with the good package reputation.

Binary authorization based on both file and package attributes

Registering a computer system for use in an enterprise. A method includes receiving, from a device management infrastructure of the enterprise, an executable system management component (SMC), and installing the SMC at a storage device. The method also includes executing the SMC, causing the computer system to register with the device management infrastructure, including applying a device settings policy to a configuration of the computer system. Executing the SMC also causes the computer system to configure itself to periodically execute a maintenance task received from the device management infrastructure. The method also includes periodically executing the maintenance task, causing the computer system to receive updated device settings policies from the device management infrastructure and apply the updated device settings policies to the configuration of the computer system, and to receive an updated application from the device management infrastructure and install the updated application at the computer system.

Limiting enterprise applications and settings on devices

Installing apps on a device. The device is generally configured to be used in a closed market environment that only allows generally available apps of the closed market to be installed. The method includes determining that the device has been authorized to install apps outside of a set of apps generally available from the closed market and from a set of apps available only to users of a particular enterprise. The method further includes determining that an app, that is not generally available from the closed market, has been verified by a central authority. The method further includes installing the app on the device in spite of the fact that the device is generally configured to be used in a closed market environment.

Enterprise management for devices

Installing apps and setting configuration on a device. A method includes receiving user input. The user input indicates a level of control that a user is willing to give an enterprise over the device. The method further includes determining, based on the level of control indicated by the user input, a set of apps allowed to install on the device. The set of apps allowed to install on the device is limited by the level of control indicated by the user. The method further includes authorizing installation of the set of apps on the device while restricting installation of other apps that would be authorized had the user selected a different level of control that the user is willing to give the enterprise over the device.

A method, system, and architecture for managing computer systems is provided. A management system employs management objects (MOs) to provide administrators the ability to intuitively express the administrative intent in an information technology (IT) environment, and to act out the administrative intent based on the information gathered by the management system. Managed elements of an IT environment, such as, by way of example, hardware components, software applications, software updates, software distribution policies, configurations, settings, etc., may be expressed as MOs. Actions, such as, by way of example, detect, install/apply, remove, remediate, enumerate, etc., may be associated with the MOs. The management system manages the computer systems by deploying the appropriate MOs and their associated actions onto the computer systems, and performing the actions on the computer systems.

Object-based computer system management

Growing community of inventors

Seattle, WA, United States of America

Jeffrey A Sutherland