From f39994fcc7a993bc3f810575bfd4c4f2fb1dda19 Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Tue, 17 Mar 2020 12:48:08 -0700 Subject: [PATCH 01/33] name changes for pngs sccm becomes configmgr --- ...cm-additional.png => configmgr-additional.png} | Bin .../{sccm-create.png => configmgr-create.png} | Bin .../{sccm-oma-uri.png => configmgr-oma-uri.png} | Bin .../{sccm-platform.png => configmgr-platform.png} | Bin .../images/{sccm-team.png => configmgr-team.png} | Bin .../manage-settings-with-mdm-for-surface-hub.md | 14 +++++++------- 6 files changed, 7 insertions(+), 7 deletions(-) rename devices/surface-hub/images/{sccm-additional.png => configmgr-additional.png} (100%) rename devices/surface-hub/images/{sccm-create.png => configmgr-create.png} (100%) rename devices/surface-hub/images/{sccm-oma-uri.png => configmgr-oma-uri.png} (100%) rename devices/surface-hub/images/{sccm-platform.png => configmgr-platform.png} (100%) rename devices/surface-hub/images/{sccm-team.png => configmgr-team.png} (100%) diff --git a/devices/surface-hub/images/sccm-additional.png b/devices/surface-hub/images/configmgr-additional.png similarity index 100% rename from devices/surface-hub/images/sccm-additional.png rename to devices/surface-hub/images/configmgr-additional.png diff --git a/devices/surface-hub/images/sccm-create.png b/devices/surface-hub/images/configmgr-create.png similarity index 100% rename from devices/surface-hub/images/sccm-create.png rename to devices/surface-hub/images/configmgr-create.png diff --git a/devices/surface-hub/images/sccm-oma-uri.png b/devices/surface-hub/images/configmgr-oma-uri.png similarity index 100% rename from devices/surface-hub/images/sccm-oma-uri.png rename to devices/surface-hub/images/configmgr-oma-uri.png diff --git a/devices/surface-hub/images/sccm-platform.png b/devices/surface-hub/images/configmgr-platform.png similarity index 100% rename from devices/surface-hub/images/sccm-platform.png rename to devices/surface-hub/images/configmgr-platform.png diff --git a/devices/surface-hub/images/sccm-team.png b/devices/surface-hub/images/configmgr-team.png similarity index 100% rename from devices/surface-hub/images/sccm-team.png rename to devices/surface-hub/images/configmgr-team.png diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index b3a74fc47d..0d30646f0b 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -18,7 +18,7 @@ ms.localizationpriority: medium Surface Hub and other Windows 10 devices allow IT administrators to manage settings and policies using a mobile device management (MDM) provider. A built-in management component communicates with the management server, so there is no need to install additional clients on the device. For more information, see [Windows 10 mobile device management](https://msdn.microsoft.com/library/windows/hardware/dn914769.aspx). -Surface Hub has been validated with Microsoft’s first-party MDM providers: +Surface Hub has been validated with Microsoft's first-party MDM providers: - Microsoft Intune standalone - On-premises MDM with Microsoft Endpoint Configuration Manager @@ -201,7 +201,7 @@ The following tables include info on Windows 10 settings that have been validate \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. ### Generate OMA URIs for settings -You need to use a setting’s OMA URI to create a custom policy in Intune, or a custom setting in Microsoft Endpoint Configuration Manager. +You need to use a setting's OMA URI to create a custom policy in Intune, or a custom setting in Microsoft Endpoint Configuration Manager. **To generate the OMA URI for any setting in the CSP documentation** 1. In the CSP documentation, identify the root node of the CSP. Generally, this looks like `./Vendor/MSFT/`
@@ -238,26 +238,26 @@ Configuration Manager supports managing modern devices that do not require the C 3. On the **General** page of the Create Configuration Item Wizard, specify a name and optional description for the configuration item. 4. Under **Settings for devices managed without the Configuration Manager client**, select **Windows 8.1 and Windows 10**, and then click **Next**. - ![example of UI](images/sccm-create.png) + ![example of UI](images/configmgr-create.png) 5. On the **Supported Platforms** page, expand **Windows 10** and select **All Windows 10 Team and higher**. Unselect the other Windows platforms, and then click **Next**. - ![select platform](images/sccm-platform.png) + ![select platform](images/configmgr-platform.png) 7. On the **Device Settings** page, under **Device settings groups**, select **Windows 10 Team**. 8. On the **Windows 10 Team** page, configure the settings you require. - ![Windows 10 Team](images/sccm-team.png) + ![Windows 10 Team](images/configmgr-team.png) 9. You'll need to create custom settings to manage settings that are not available in the Windows 10 Team page. On the **Device Settings** page, select the check box **Configure additional settings that are not in the default setting groups**. - ![additional settings](images/sccm-additional.png) + ![additional settings](images/configmgr-additional.png) 10. On the **Additional Settings** page, click **Add**. 11. In the **Browse Settings** dialog, click **Create Setting**. 12. In the **Create Setting** dialog, under the **General** tab, specify a name and optional description for the custom setting. 13. Under **Setting type**, select **OMA URI**. 14. Complete the form to create a new setting, and then click **OK**. - ![OMA URI setting](images/sccm-oma-uri.png) + ![OMA URI setting](images/configmgr-oma-uri.png) 15. On the **Browse Settings** dialog, under **Available settings**, select the new setting you created, and then click **Select**. 16. On the **Create Rule** dialog, complete the form to specify a rule for the setting, and then click **OK**. 17. Repeat steps 9 to 15 for each custom setting you want to add to the configuration item. From b6c1a1d972b10611c4a72188e0cd0ba72148f432 Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Tue, 17 Mar 2020 13:55:06 -0700 Subject: [PATCH 02/33] png name chgs for deployment and configuration --- .../{sccm-asset.PNG => configmgr-asset.PNG} | Bin .../{sccm-assets.PNG => configmgr-assets.PNG} | Bin .../{sccm-client.PNG => configmgr-client.PNG} | Bin ...ollection.PNG => configmgr-collection.PNG} | Bin ...nstall-os.PNG => configmgr-install-os.PNG} | Bin ...refresh.PNG => configmgr-post-refresh.PNG} | Bin .../{sccm-pxe.PNG => configmgr-pxe.PNG} | Bin .../{sccm-site.PNG => configmgr-site.PNG} | Bin ...e-cntr.PNG => configmgr-software-cntr.PNG} | Bin .../{sccm-asset.PNG => configmgr-asset.png} | Bin .../{sccm-assets.PNG => configmgr-assets.png} | Bin .../{sccm-client.PNG => configmgr-client.PNG} | Bin ...ollection.PNG => configmgr-collection.PNG} | Bin ...nstall-os.PNG => configmgr-install-os.PNG} | Bin ...refresh.PNG => configmgr-post-refresh.PNG} | Bin .../{sccm-pxe.PNG => configmgr-pxe.PNG} | Bin .../{sccm-site.PNG => configmgr-site.PNG} | Bin ...e-cntr.PNG => configmgr-software-cntr.PNG} | Bin .../windows-10-poc-sc-config-mgr.md | 34 +++++++++--------- 19 files changed, 17 insertions(+), 17 deletions(-) rename windows/configuration/images/{sccm-asset.PNG => configmgr-asset.PNG} (100%) rename windows/configuration/images/{sccm-assets.PNG => configmgr-assets.PNG} (100%) rename windows/configuration/images/{sccm-client.PNG => configmgr-client.PNG} (100%) rename windows/configuration/images/{sccm-collection.PNG => configmgr-collection.PNG} (100%) rename windows/configuration/images/{sccm-install-os.PNG => configmgr-install-os.PNG} (100%) rename windows/configuration/images/{sccm-post-refresh.PNG => configmgr-post-refresh.PNG} (100%) rename windows/configuration/images/{sccm-pxe.PNG => configmgr-pxe.PNG} (100%) rename windows/configuration/images/{sccm-site.PNG => configmgr-site.PNG} (100%) rename windows/configuration/images/{sccm-software-cntr.PNG => configmgr-software-cntr.PNG} (100%) rename windows/deployment/images/{sccm-asset.PNG => configmgr-asset.png} (100%) rename windows/deployment/images/{sccm-assets.PNG => configmgr-assets.png} (100%) rename windows/deployment/images/{sccm-client.PNG => configmgr-client.PNG} (100%) rename windows/deployment/images/{sccm-collection.PNG => configmgr-collection.PNG} (100%) rename windows/deployment/images/{sccm-install-os.PNG => configmgr-install-os.PNG} (100%) rename windows/deployment/images/{sccm-post-refresh.PNG => configmgr-post-refresh.PNG} (100%) rename windows/deployment/images/{sccm-pxe.PNG => configmgr-pxe.PNG} (100%) rename windows/deployment/images/{sccm-site.PNG => configmgr-site.PNG} (100%) rename windows/deployment/images/{sccm-software-cntr.PNG => configmgr-software-cntr.PNG} (100%) diff --git a/windows/configuration/images/sccm-asset.PNG b/windows/configuration/images/configmgr-asset.PNG similarity index 100% rename from windows/configuration/images/sccm-asset.PNG rename to windows/configuration/images/configmgr-asset.PNG diff --git a/windows/configuration/images/sccm-assets.PNG b/windows/configuration/images/configmgr-assets.PNG similarity index 100% rename from windows/configuration/images/sccm-assets.PNG rename to windows/configuration/images/configmgr-assets.PNG diff --git a/windows/configuration/images/sccm-client.PNG b/windows/configuration/images/configmgr-client.PNG similarity index 100% rename from windows/configuration/images/sccm-client.PNG rename to windows/configuration/images/configmgr-client.PNG diff --git a/windows/configuration/images/sccm-collection.PNG b/windows/configuration/images/configmgr-collection.PNG similarity index 100% rename from windows/configuration/images/sccm-collection.PNG rename to windows/configuration/images/configmgr-collection.PNG diff --git a/windows/configuration/images/sccm-install-os.PNG b/windows/configuration/images/configmgr-install-os.PNG similarity index 100% rename from windows/configuration/images/sccm-install-os.PNG rename to windows/configuration/images/configmgr-install-os.PNG diff --git a/windows/configuration/images/sccm-post-refresh.PNG b/windows/configuration/images/configmgr-post-refresh.PNG similarity index 100% rename from windows/configuration/images/sccm-post-refresh.PNG rename to windows/configuration/images/configmgr-post-refresh.PNG diff --git a/windows/configuration/images/sccm-pxe.PNG b/windows/configuration/images/configmgr-pxe.PNG similarity index 100% rename from windows/configuration/images/sccm-pxe.PNG rename to windows/configuration/images/configmgr-pxe.PNG diff --git a/windows/configuration/images/sccm-site.PNG b/windows/configuration/images/configmgr-site.PNG similarity index 100% rename from windows/configuration/images/sccm-site.PNG rename to windows/configuration/images/configmgr-site.PNG diff --git a/windows/configuration/images/sccm-software-cntr.PNG b/windows/configuration/images/configmgr-software-cntr.PNG similarity index 100% rename from windows/configuration/images/sccm-software-cntr.PNG rename to windows/configuration/images/configmgr-software-cntr.PNG diff --git a/windows/deployment/images/sccm-asset.PNG b/windows/deployment/images/configmgr-asset.png similarity index 100% rename from windows/deployment/images/sccm-asset.PNG rename to windows/deployment/images/configmgr-asset.png diff --git a/windows/deployment/images/sccm-assets.PNG b/windows/deployment/images/configmgr-assets.png similarity index 100% rename from windows/deployment/images/sccm-assets.PNG rename to windows/deployment/images/configmgr-assets.png diff --git a/windows/deployment/images/sccm-client.PNG b/windows/deployment/images/configmgr-client.PNG similarity index 100% rename from windows/deployment/images/sccm-client.PNG rename to windows/deployment/images/configmgr-client.PNG diff --git a/windows/deployment/images/sccm-collection.PNG b/windows/deployment/images/configmgr-collection.PNG similarity index 100% rename from windows/deployment/images/sccm-collection.PNG rename to windows/deployment/images/configmgr-collection.PNG diff --git a/windows/deployment/images/sccm-install-os.PNG b/windows/deployment/images/configmgr-install-os.PNG similarity index 100% rename from windows/deployment/images/sccm-install-os.PNG rename to windows/deployment/images/configmgr-install-os.PNG diff --git a/windows/deployment/images/sccm-post-refresh.PNG b/windows/deployment/images/configmgr-post-refresh.PNG similarity index 100% rename from windows/deployment/images/sccm-post-refresh.PNG rename to windows/deployment/images/configmgr-post-refresh.PNG diff --git a/windows/deployment/images/sccm-pxe.PNG b/windows/deployment/images/configmgr-pxe.PNG similarity index 100% rename from windows/deployment/images/sccm-pxe.PNG rename to windows/deployment/images/configmgr-pxe.PNG diff --git a/windows/deployment/images/sccm-site.PNG b/windows/deployment/images/configmgr-site.PNG similarity index 100% rename from windows/deployment/images/sccm-site.PNG rename to windows/deployment/images/configmgr-site.PNG diff --git a/windows/deployment/images/sccm-software-cntr.PNG b/windows/deployment/images/configmgr-software-cntr.PNG similarity index 100% rename from windows/deployment/images/sccm-software-cntr.PNG rename to windows/deployment/images/configmgr-software-cntr.PNG diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index 944908ad16..4f273824cb 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -108,11 +108,11 @@ Topics and procedures in this guide are summarized in the following table. An es 5. Type the following commands at an elevated Windows PowerShell prompt on SRV1: ``` - New-NetFirewallRule -DisplayName “SQL Server” -Direction Inbound –Protocol TCP –LocalPort 1433 -Action allow - New-NetFirewallRule -DisplayName “SQL Admin Connection” -Direction Inbound –Protocol TCP –LocalPort 1434 -Action allow - New-NetFirewallRule -DisplayName “SQL Database Management” -Direction Inbound –Protocol UDP –LocalPort 1434 -Action allow - New-NetFirewallRule -DisplayName “SQL Service Broker” -Direction Inbound –Protocol TCP –LocalPort 4022 -Action allow - New-NetFirewallRule -DisplayName “SQL Debugger/RPC” -Direction Inbound –Protocol TCP –LocalPort 135 -Action allow + New-NetFirewallRule -DisplayName "SQL Server" -Direction Inbound –Protocol TCP –LocalPort 1433 -Action allow + New-NetFirewallRule -DisplayName "SQL Admin Connection" -Direction Inbound –Protocol TCP –LocalPort 1434 -Action allow + New-NetFirewallRule -DisplayName "SQL Database Management" -Direction Inbound –Protocol UDP –LocalPort 1434 -Action allow + New-NetFirewallRule -DisplayName "SQL Service Broker" -Direction Inbound –Protocol TCP –LocalPort 4022 -Action allow + New-NetFirewallRule -DisplayName "SQL Debugger/RPC" -Direction Inbound –Protocol TCP –LocalPort 135 -Action allow ``` 7. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 1703. Installation might require several minutes to acquire all components. @@ -123,7 +123,7 @@ Topics and procedures in this guide are summarized in the following table. An es ``` $AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" - Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 0 + Set-ItemProperty -Path $AdminKey -Name "IsInstalled" -Value 0 Stop-Process -Name Explorer ``` @@ -207,7 +207,7 @@ Topics and procedures in this guide are summarized in the following table. An es 19. If desired, re-enable IE Enhanced Security Configuration at this time on SRV1: ``` - Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 1 + Set-ItemProperty -Path $AdminKey -Name "IsInstalled" -Value 1 Stop-Process -Name Explorer ``` @@ -326,7 +326,7 @@ WDSUTIL /Set-Server /AnswerClients:None See the following example: - Config Mgr PXE + Config Mgr PXE 5. Click **OK**. 6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present: @@ -387,7 +387,7 @@ WDSUTIL /Set-Server /AnswerClients:None In the trace tool, click **Tools** on the menu and choose **Find**. Search for "**STATMSG: ID=2301**". For example: ``` - STATMSG: ID=2301 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SRV1.CONTOSO.COM SITE=PS1 PID=924 TID=1424 GMTDATE=Tue Oct 09 22:36:30.986 2018 ISTR0="Zero Touch WinPE x64" ISTR1="PS10000A" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="PS10000A" SMS_DISTRIBUTION_MANAGER 10/9/2018 3:36:30 PM 1424 (0x0590) + STATMSG: ID=2301 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SRV1.CONTOSO.COM SITE=PS1 PID=924 TID=1424 GMTDATE=Tue Oct 09 22:36:30.986 2018 ISTR0="Zero Touch WinPE x64" ISTR1="PS10000A" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="PS10000A" SMS_DISTRIBUTION_MANAGER 10/9/2018 3:36:30 PM 1424 (0x0590) ``` 11. You can also review status by clicking the **Zero Touch WinPE x64** image, and then clicking **Content Status** under **Related Objects** in the bottom right-hand corner of the console, or by entering **\Monitoring\Overview\Distribution Status\Content Status** on the location bar in the console. Double-click **Zero Touch WinPE x64** under **Content Status** in the console tree and verify that a status of **Successfully distributed content** is displayed on the **Success** tab. @@ -847,7 +847,7 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 6. When a popup dialog box asks if you want to run full discovery, click **Yes**. 7. In the Assets and Compliance workspace, click **Devices** and verify that the computer account names for SRV1 and PC1 are displayed. See the following example (GREGLIN-PC1 is the computer account name of PC1 in this example): - ![assets](images/sccm-assets.png) + ![assets](images/configmgr-assets.png) >If you do not see the computer account for PC1, try clicking the **Refresh** button in the upper right corner of the console. @@ -900,7 +900,7 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 14. Click the **Site** tab, click **Configure Settings**, and click **Find Site**. The client will report that it has found the PS1 site. See the following example: - ![site](images/sccm-site.png) + ![site](images/configmgr-site.png) If the client is not able to find the PS1 site, review any error messages that are displayed in **C:\Windows\CCM\Logs\ClientIDManagerStartup.log** and **LocationServices.log**. A common reason the site code is not located is because a previous configuration exists. For example, if a previous site code is configured at **HKLM\SOFTWARE\Microsoft\SMS\Mobile Client\GPRequestedSiteAssignmentCode** this must be deleted or updated. @@ -908,7 +908,7 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 16. Click **All Desktop and Server Clients** and verify that the computer account for PC1 is displayed here with **Yes** and **Active** in the **Client** and **Client Activity** columns, respectively. You might have to refresh the view and wait few minutes for the client to appear here. See the following example: - ![client](images/sccm-client.png) + ![client](images/configmgr-client.png) >It might take several minutes for the client to fully register with the site and complete a client check. When it is complete you will see a green check mark over the client icon as shown above. To refresh the client, click it and then press **F5** or right-click the client and click **Refresh**. @@ -970,7 +970,7 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 11. Click **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. Verify that **PC4** is displayed in the collection. You might have to update and refresh the collection, or wait a few minutes, but do not proceed until PC4 is available. See the following example: - ![collection](images/sccm-collection.png) + ![collection](images/configmgr-collection.png) ### Create a device collection for PC1 @@ -1018,7 +1018,7 @@ In the Configuration Manager console, in the Software Library workspace under Op 4. In the Software Center , click **Available Software** and then select the **Replace Task Sequence** checkbox. See the following example: - ![software](images/sccm-software-cntr.png) + ![software](images/configmgr-software-cntr.png) >If you do not see any available software, try running step #2 again to start the Machine Policy Retrieval & Evaluation Cycle. You should see an alert that new software is available. @@ -1056,17 +1056,17 @@ In the Configuration Manager console, in the Software Library workspace under Op 3. On PC1, in the notification area, click **New software is available** and then click **Open Software Center**. 4. In the Software Center, click **Operating Systems**, click **Windows 10 Enterprise x64**, click **Install** and then click **INSTALL OPERATING SYSTEM**. See the following example: - ![installOS](images/sccm-install-os.png) + ![installOS](images/configmgr-install-os.png) The computer will restart several times during the installation process. Installation includes downloading updates, reinstalling the Configuration Manager Client Agent, and restoring the user state. You can view status of the installation in the Configuration Manager console by accessing the Monitoring workspace, clicking **Deployments**, and then double-clicking the deployment associated with the **Install Windows 10 Enterprise x64** collection. Under **Asset Details**, right-click the device and then click **More Details**. Click the **Status** tab to see a list of tasks that have been performed. See the following example: - ![asset](images/sccm-asset.png) + ![asset](images/configmgr-asset.png) You can also monitor progress of the installation by using the MDT deployment workbench and viewing the **Monitoring** node under **Deployment Shares\MDT Production**. When installation has completed, sign in using the contoso\administrator account or the contoso\user1 account and verify that applications and settings have been successfully backed up and restored to your new Windows 10 Enterprise operating system. - ![post-refresh](images/sccm-post-refresh.png) + ![post-refresh](images/configmgr-post-refresh.png) From 95d5bd2737117eb6b0289e96562f1e3d6075f720 Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Tue, 17 Mar 2020 18:06:49 -0700 Subject: [PATCH 03/33] png name updates plus two md updates --- .../security/information-protection/TOC.md | 6 +- ...geconfig.jpg => configmgr-imageconfig.jpg} | Bin .../bitlocker/ts-bitlocker-intune-issues.md | 4 +- ...reate-and-verify-an-efs-dra-certificate.md | 18 +-- ...d => create-wip-policy-using-configmgr.md} | 104 +++++++++--------- ...g => wip-configmgr-add-network-domain.png} | Bin ...png => wip-configmgr-addapplockerfile.png} | Bin ...pp.png => wip-configmgr-adddesktopapp.png} | Bin ...g => wip-configmgr-additionalsettings.png} | Bin ...policy.png => wip-configmgr-addpolicy.png} | Bin ....png => wip-configmgr-adduniversalapp.png} | Bin ...-appmgmt.png => wip-configmgr-appmgmt.png} | Bin ...ty.png => wip-configmgr-corp-identity.png} | Bin ...s.png => wip-configmgr-devicesettings.png} | Bin ...wip-sccm-dra.png => wip-configmgr-dra.png} | Bin ...en.png => wip-configmgr-generalscreen.png} | Bin ...n.png => wip-configmgr-network-domain.png} | Bin ...ings.png => wip-configmgr-optsettings.png} | Bin ...en.png => wip-configmgr-summaryscreen.png} | Bin ...at.png => wip-configmgr-supportedplat.png} | Bin .../overview-create-wip-policy-sccm.md | 2 +- .../testing-scenarios-for-wip.md | 4 +- 22 files changed, 69 insertions(+), 69 deletions(-) rename windows/security/information-protection/bitlocker/images/{sccm-imageconfig.jpg => configmgr-imageconfig.jpg} (100%) rename windows/security/information-protection/windows-information-protection/{create-wip-policy-using-sccm.md => create-wip-policy-using-configmgr.md} (78%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-add-network-domain.png => wip-configmgr-add-network-domain.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-addapplockerfile.png => wip-configmgr-addapplockerfile.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-adddesktopapp.png => wip-configmgr-adddesktopapp.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-additionalsettings.png => wip-configmgr-additionalsettings.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-addpolicy.png => wip-configmgr-addpolicy.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-adduniversalapp.png => wip-configmgr-adduniversalapp.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-appmgmt.png => wip-configmgr-appmgmt.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-corp-identity.png => wip-configmgr-corp-identity.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-devicesettings.png => wip-configmgr-devicesettings.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-dra.png => wip-configmgr-dra.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-generalscreen.png => wip-configmgr-generalscreen.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-network-domain.png => wip-configmgr-network-domain.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-optsettings.png => wip-configmgr-optsettings.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-summaryscreen.png => wip-configmgr-summaryscreen.png} (100%) rename windows/security/information-protection/windows-information-protection/images/{wip-sccm-supportedplat.png => wip-configmgr-supportedplat.png} (100%) diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md index c3c19ee400..6d79db4dc3 100644 --- a/windows/security/information-protection/TOC.md +++ b/windows/security/information-protection/TOC.md @@ -38,7 +38,7 @@ ## [Encrypted Hard Drive](encrypted-hard-drive.md) -## [Kernel DMA Protection for Thunderbolt™ 3](kernel-dma-protection-for-thunderbolt.md) +## [Kernel DMA Protection for Thunderbolt™ 3](kernel-dma-protection-for-thunderbolt.md) ## [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection\protect-enterprise-data-using-wip.md) ### [Create a WIP policy using Microsoft Intune](windows-information-protection\overview-create-wip-policy.md) @@ -47,8 +47,8 @@ ##### [Associate and deploy a VPN policy for WIP using the Azure portal for Microsoft Intune](windows-information-protection\create-vpn-and-wip-policy-using-intune-azure.md) #### [Create and verify an EFS Data Recovery Agent (DRA) certificate](windows-information-protection\create-and-verify-an-efs-dra-certificate.md) #### [Determine the Enterprise Context of an app running in WIP](windows-information-protection\wip-app-enterprise-context.md) -### [Create a WIP policy using Microsoft Endpoint Configuration Manager](windows-information-protection\overview-create-wip-policy-sccm.md) -#### [Create and deploy a WIP policy using Microsoft Endpoint Configuration Manager](windows-information-protection\create-wip-policy-using-sccm.md) +### [Create a WIP policy using Microsoft Endpoint Configuration Manager](windows-information-protection\overview-create-wip-policy-configmgr.md) +#### [Create and deploy a WIP policy using Microsoft Endpoint Configuration Manager](windows-information-protection\create-wip-policy-using-configmgr.md) #### [Create and verify an EFS Data Recovery Agent (DRA) certificate](windows-information-protection\create-and-verify-an-efs-dra-certificate.md) #### [Determine the Enterprise Context of an app running in WIP](windows-information-protection\wip-app-enterprise-context.md) ### [Mandatory tasks and settings required to turn on WIP](windows-information-protection\mandatory-settings-for-wip.md) diff --git a/windows/security/information-protection/bitlocker/images/sccm-imageconfig.jpg b/windows/security/information-protection/bitlocker/images/configmgr-imageconfig.jpg similarity index 100% rename from windows/security/information-protection/bitlocker/images/sccm-imageconfig.jpg rename to windows/security/information-protection/bitlocker/images/configmgr-imageconfig.jpg diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md index 2f83a67ca2..18236c1ddf 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md @@ -111,7 +111,7 @@ list volume If the status of any of the volumes is not healthy or if the recovery partition is missing, you may have to reinstall Windows. Before you do this, check the configuration of the Windows image that you are using for provisioning. Make sure that the image uses the correct disk configuration. The image configuration should resemble the following (this example is from Microsoft Endpoint Configuration Manager). -![Windows image configuration in Microsoft Endpoint Configuration Manager](./images/sccm-imageconfig.jpg) +![Windows image configuration in Microsoft Endpoint Configuration Manager](./images/configmgr-imageconfig.jpg) #### Step 2: Verify the status of WinRE @@ -171,7 +171,7 @@ To verify the BIOS mode, use the System Information app. To do this, follow thes You receive an error message that resembles the following: -> **Error:** BitLocker cannot use Secure Boot for integrity because the UEFI variable ‘SecureBoot’ could not be read. A required privilege is not held by the client. +> **Error:** BitLocker cannot use Secure Boot for integrity because the UEFI variable 'SecureBoot' could not be read. A required privilege is not held by the client. ### Cause diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index d2a77a72e2..2bcfcf6622 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -23,12 +23,12 @@ ms.reviewer: - Windows 10, version 1607 and later - Windows 10 Mobile, version 1607 and later -If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. +If you don't already have an EFS DRA certificate, you'll need to create and extract one from your system before you can use Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your organization. For the purposes of this section, we'll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. The recovery process included in this topic only works for desktop devices. WIP deletes the data on Windows 10 Mobile devices. >[!IMPORTANT] ->If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. For more info about when to use a PKI and the general strategy you should use to deploy DRA certificates, see the [Security Watch Deploying EFS: Part 1](https://technet.microsoft.com/magazine/2007.02.securitywatch.aspx) article on TechNet. For more general info about EFS protection, see [Protecting Data by Using EFS to Encrypt Hard Drives](https://msdn.microsoft.com/library/cc875821.aspx).

If your DRA certificate has expired, you won’t be able to encrypt your files with it. To fix this, you'll need to create a new certificate, using the steps in this topic, and then deploy it through policy. +>If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. For more info about when to use a PKI and the general strategy you should use to deploy DRA certificates, see the [Security Watch Deploying EFS: Part 1](https://technet.microsoft.com/magazine/2007.02.securitywatch.aspx) article on TechNet. For more general info about EFS protection, see [Protecting Data by Using EFS to Encrypt Hard Drives](https://msdn.microsoft.com/library/cc875821.aspx).

If your DRA certificate has expired, you won't be able to encrypt your files with it. To fix this, you'll need to create a new certificate, using the steps in this topic, and then deploy it through policy. ## Manually create an EFS DRA certificate @@ -47,16 +47,16 @@ The recovery process included in this topic only works for desktop devices. WIP >[!Important] >Because the private keys in your DRA .pfx files can be used to decrypt any WIP file, you must protect them accordingly. We highly recommend storing these files offline, keeping copies on a smart card with strong protection for normal use and master copies in a secured physical location. -4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as [Microsoft Intune](create-wip-policy-using-intune-azure.md) or [Microsoft Endpoint Configuration Manager](create-wip-policy-using-sccm.md). +4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as [Microsoft Intune](create-wip-policy-using-intune-azure.md) or [Microsoft Endpoint Configuration Manager](create-wip-policy-using-configmgr.md). > [!NOTE] > This certificate can be used in Intune for policies both _with_ device enrollment (MDM) and _without_ device enrollment (MAM). ## Verify your data recovery certificate is correctly set up on a WIP client computer -1. Find or create a file that's encrypted using Windows Information Protection. For example, you could open an app on your allowed app list, and then create and save a file so it’s encrypted by WIP. +1. Find or create a file that's encrypted using Windows Information Protection. For example, you could open an app on your allowed app list, and then create and save a file so it's encrypted by WIP. -2. Open an app on your protected app list, and then create and save a file so that it’s encrypted by WIP. +2. Open an app on your protected app list, and then create and save a file so that it's encrypted by WIP. 3. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command: @@ -89,7 +89,7 @@ It's possible that you might revoke data from an unenrolled device only to later Robocopy "%localappdata%\Microsoft\EDP\Recovery" "new_location" * /EFSRAW - Where "*new_location*" is in a different directory. This can be on the employee’s device or on a shared folder on a computer that runs Windows 8 or Windows Server 2012 or newer and can be accessed while you're logged in as a data recovery agent. + Where "*new_location*" is in a different directory. This can be on the employee's device or on a shared folder on a computer that runs Windows 8 or Windows Server 2012 or newer and can be accessed while you're logged in as a data recovery agent. To start Robocopy in S mode, open Task Manager. Click **File** > **Run new task**, type the command, and click **Create this task with administrative privileges**. @@ -109,12 +109,12 @@ It's possible that you might revoke data from an unenrolled device only to later 4. Ask the employee to lock and unlock the device. - The Windows Credential service automatically recovers the employee’s previously revoked keys from the `Recovery\Input` location. + The Windows Credential service automatically recovers the employee's previously revoked keys from the `Recovery\Input` location. ## Auto-recovery of encryption keys Starting with Windows 10, version 1709, WIP includes a data recovery feature that lets your employees auto-recover access to work files if the encryption key is lost and the files are no longer accessible. This typically happens if an employee reimages the operating system partition, removing the WIP key info, or if a device is reported as lost and you mistakenly target the wrong device for unenrollment. -To help make sure employees can always access files, WIP creates an auto-recovery key that’s backed up to their Azure Active Directory (Azure AD) identity. +To help make sure employees can always access files, WIP creates an auto-recovery key that's backed up to their Azure Active Directory (Azure AD) identity. The employee experience is based on sign in with an Azure AD work account. The employee can either: @@ -147,7 +147,7 @@ After signing in, the necessary WIP key info is automatically downloaded and emp - [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune-azure.md) -- [Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-sccm.md) +- [Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-configmgr.md) - [Creating a Domain-Based Recovery Agent](https://msdn.microsoft.com/library/cc875821.aspx#EJAA) diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md similarity index 78% rename from windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md rename to windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md index 9d1178639c..a5baa19809 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md @@ -25,10 +25,10 @@ ms.date: 01/09/2020 - Windows 10 Mobile, version 1607 and later - Microsoft Endpoint Configuration Manager -Microsoft Endpoint Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network. +Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network. ## Add a WIP policy -After you’ve installed and set up Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy. +After you've installed and set up Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy. >[!TIP] > Review the [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) article before creating a new configuration item to avoid common issues. @@ -37,16 +37,16 @@ After you’ve installed and set up Configuration Manager for your organization, 1. Open the Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node. - ![Configuration Manager, Configuration Items screen](images/wip-sccm-addpolicy.png) + ![Configuration Manager, Configuration Items screen](images/wip-configmgr-addpolicy.png) 2. Click the **Create Configuration Item** button.

The **Create Configuration Item Wizard** starts. - ![Create Configuration Item wizard, define the configuration item and choose the configuration type](images/wip-sccm-generalscreen.png) + ![Create Configuration Item wizard, define the configuration item and choose the configuration type](images/wip-configmgr-generalscreen.png) 3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. -4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use Microsoft Endpoint Configuration Manager for device management, and then click **Next**. +4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use Configuration Manager for device management, and then click **Next**. - **Settings for devices managed with the Configuration Manager client:** Windows 10 @@ -56,25 +56,25 @@ The **Create Configuration Item Wizard** starts. 5. On the **Supported Platforms** screen, click the **Windows 10** box, and then click **Next**. - ![Create Configuration Item wizard, choose the supported platforms for the policy](images/wip-sccm-supportedplat.png) + ![Create Configuration Item wizard, choose the supported platforms for the policy](images/wip-configmgr-supportedplat.png) 6. On the **Device Settings** screen, click **Windows Information Protection**, and then click **Next**. - ![Create Configuration Item wizard, choose the Windows Information Protection settings](images/wip-sccm-devicesettings.png) + ![Create Configuration Item wizard, choose the Windows Information Protection settings](images/wip-configmgr-devicesettings.png) The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization. ## Add app rules to your policy -During the policy-creation process in Microsoft Endpoint Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. +During the policy-creation process in Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file. >[!IMPORTANT] ->Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. +>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App rules** list. If you don't get this statement, it's possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. ### Add a store app rule to your policy -For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list. +For this example, we're going to add Microsoft OneNote, a store app, to the **App Rules** list. **To add a store app** @@ -82,13 +82,13 @@ For this example, we’re going to add Microsoft OneNote, a store app, to the ** The **Add app rule** box appears. - ![Create Configuration Item wizard, add a universal store app](images/wip-sccm-adduniversalapp.png) + ![Create Configuration Item wizard, add a universal store app](images/wip-configmgr-adduniversalapp.png) -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*. +2. Add a friendly name for your app into the **Title** box. In this example, it's *Microsoft OneNote*. 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. + Allow turns on WIP, helping to protect that app's corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. 4. Pick **Store App** from the **Rule template** drop-down list. @@ -122,7 +122,7 @@ If you don't know the publisher or product name, you can find them for both desk 4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of Intune. > [!IMPORTANT] - > The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.

For example:

+ > The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that's using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as "CN=" followed by the `windowsPhoneLegacyId`.

For example:

> ```json > { > "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", @@ -150,7 +150,7 @@ If you don't know the publisher or product name, you can find them for both desk 8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. > [!IMPORTANT] - > The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. + > The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that's using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as "CN=" followed by the `windowsPhoneLegacyId`. > For example:

> ```json > { @@ -159,20 +159,20 @@ If you don't know the publisher or product name, you can find them for both desk > ``` ### Add a desktop app rule to your policy -For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list. +For this example, we're going to add Internet Explorer, a desktop app, to the **App Rules** list. **To add a desktop app to your policy** 1. From the **App rules** area, click **Add**. The **Add app rule** box appears. - ![Create Configuration Item wizard, add a classic desktop app](images/wip-sccm-adddesktopapp.png) + ![Create Configuration Item wizard, add a classic desktop app](images/wip-configmgr-adddesktopapp.png) -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*. +2. Add a friendly name for your app into the **Title** box. In this example, it's *Internet Explorer*. 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. + Allow turns on WIP, helping to protect that app's corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. 4. Pick **Desktop App** from the **Rule template** drop-down list. @@ -186,7 +186,7 @@ For this example, we’re going to add Internet Explorer, a desktop app, to the Manages - All fields left as “*” + All fields left as "*" All files signed by any publisher. (Not recommended.) @@ -215,7 +215,7 @@ For this example, we’re going to add Internet Explorer, a desktop app, to the -If you’re unsure about what to include for the publisher, you can run this PowerShell command: +If you're unsure about what to include for the publisher, you can run this PowerShell command: ```ps1 Get-AppLockerFileInformation -Path "" @@ -232,7 +232,7 @@ Path Publisher Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box. ### Add an AppLocker policy file -For this example, we’re going to add an AppLocker XML file to the **App Rules** list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) content. +For this example, we're going to add an AppLocker XML file to the **App Rules** list. You'll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) content. **To create an app rule and xml file using the AppLocker tool** 1. Open the Local Security Policy snap-in (SecPol.msc). @@ -257,7 +257,7 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* ![Create Packaged app Rules wizard, showing the Publisher](images/intune-applocker-publisher.png) -7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Photos. +7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we're using Microsoft Photos. ![Create Packaged app Rules wizard, showing the Select applications page](images/intune-applocker-select-apps.png) @@ -277,7 +277,7 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* 11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. - The policy is saved and you’ll see a message that says 1 rule was exported from the policy. + The policy is saved and you'll see a message that says 1 rule was exported from the policy. **Example XML file**
This is the XML file that AppLocker creates for Microsoft Photos. @@ -299,7 +299,7 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* ``` -12. After you’ve created your XML file, you need to import it by using Microsoft Endpoint Configuration Manager. +12. After you've created your XML file, you need to import it by using Configuration Manager. **To import your Applocker policy file app rule using Configuration Manager** @@ -307,13 +307,13 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* The **Add app rule** box appears. - ![Create Configuration Item wizard, add an AppLocker policy](images/wip-sccm-addapplockerfile.png) + ![Create Configuration Item wizard, add an AppLocker policy](images/wip-configmgr-addapplockerfile.png) -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*. +2. Add a friendly name for your app into the **Title** box. In this example, it's *Allowed app list*. 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. + Allow turns on WIP, helping to protect that app's corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. 4. Pick the **AppLocker policy file** from the **Rule template** drop-down list. @@ -332,13 +332,13 @@ If you're running into compatibility issues where your app is incompatible with The **Add app rule** box appears. -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*. +2. Add a friendly name for your app into the **Title** box. In this example, it's *Exempt apps list*. 3. Click **Exempt** from the **Windows Information Protection mode** drop-down list. - Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. + Be aware that when you exempt apps, they're allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. -4. Fill out the rest of the app rule info, based on the type of rule you’re adding: +4. Fill out the rest of the app rule info, based on the type of rule you're adding: - **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic. @@ -360,13 +360,13 @@ We recommend that you start with **Silent** or **Override** while verifying with |-----|------------| |Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| |Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. | -|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.| -|Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| +|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would've been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.| +|Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn't automatically reapplied if you turn WIP protection back on.| -![Create Configuration Item wizard, choose your WIP-protection level](images/wip-sccm-appmgmt.png) +![Create Configuration Item wizard, choose your WIP-protection level](images/wip-configmgr-appmgmt.png) ## Define your enterprise-managed identity domains -Corporate identity, usually expressed as your primary internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies. +Corporate identity, usually expressed as your primary internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you've marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies. You can specify multiple domains owned by your enterprise by separating them with the "|" character. For example, (contoso.com|newcontoso.com). With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list. @@ -374,16 +374,16 @@ You can specify multiple domains owned by your enterprise by separating them wit - Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`. - ![Create Configuration Item wizard, Add the primary Internet domain for your enterprise identity](images/wip-sccm-corp-identity.png) + ![Create Configuration Item wizard, Add the primary Internet domain for your enterprise identity](images/wip-configmgr-corp-identity.png) ## Choose where apps can access enterprise data After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. -There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). +There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise's range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). >[!IMPORTANT] >Every WIP policy should include policy that defines your enterprise network locations.
->Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations. +>Classless Inter-Domain Routing (CIDR) notation isn't supported for WIP configurations. **To define where your protected apps can find and send enterprise data on you network** @@ -393,7 +393,7 @@ There are no default locations included with WIP, you must add each of your netw 2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. - ![Add or edit corporate network definition box, Add your enterprise network locations](images/wip-sccm-add-network-domain.png) + ![Add or edit corporate network definition box, Add your enterprise network locations](images/wip-configmgr-add-network-domain.png) @@ -404,7 +404,7 @@ There are no default locations included with WIP, you must add each of your netw - + @@ -414,12 +414,12 @@ There are no default locations included with WIP, you must add each of your netw - + -
+
@@ -442,7 +442,7 @@ There are no default locations included with WIP, you must add each of your netw 4. Decide if you want to Windows to look for additional network settings and if you want to show the WIP icon on your corporate files while in File Explorer. - ![Create Configuration Item wizard, Add whether to search for additional network settings](images/wip-sccm-optsettings.png) + ![Create Configuration Item wizard, Add whether to search for additional network settings](images/wip-configmgr-optsettings.png) - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. Not configured is the default option. @@ -452,16 +452,16 @@ There are no default locations included with WIP, you must add each of your netw 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/wip-sccm-dra.png) + ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/wip-configmgr-dra.png) - After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. + After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees' local device drive. If somehow the employees' local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md). ## Choose your optional WIP-related settings -After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings. +After you've decided where your protected apps can access enterprise data on your network, you'll be asked to decide if you want to add any optional WIP settings. -![Create Configuration Item wizard, Choose any additional, optional settings](images/wip-sccm-additionalsettings.png) +![Create Configuration Item wizard, Choose any additional, optional settings](images/wip-configmgr-additionalsettings.png) **To set your optional settings** 1. Choose to set any or all of the optional settings: @@ -478,13 +478,13 @@ After you've decided where your protected apps can access enterprise data on you - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. - - **Revoke local encryption keys during the unenrollment process.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: + - **Revoke local encryption keys during the unenrollment process.** Determines whether to revoke a user's local encryption keys from a device when it's unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: - **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. - - **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. + - **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you're migrating between Mobile Device Management (MDM) solutions. - - **Allow Azure RMS.** Enables secure sharing of files by using removable media such as USB drives. For more information about how RMS works with WIP, see [Create a WIP policy using Intune](create-wip-policy-using-intune-azure.md). To confirm what templates your tenant has, run [Get-AadrmTemplate](https://docs.microsoft.com/powershell/module/aadrm/get-aadrmtemplate) from the [AADRM PowerShell module](https://docs.microsoft.com/azure/information-protection/administer-powershell). If you don’t specify a template, WIP uses a key from a default RMS template that everyone in the tenant will have access to. + - **Allow Azure RMS.** Enables secure sharing of files by using removable media such as USB drives. For more information about how RMS works with WIP, see [Create a WIP policy using Intune](create-wip-policy-using-intune-azure.md). To confirm what templates your tenant has, run [Get-AadrmTemplate](https://docs.microsoft.com/powershell/module/aadrm/get-aadrmtemplate) from the [AADRM PowerShell module](https://docs.microsoft.com/azure/information-protection/administer-powershell). If you don't specify a template, WIP uses a key from a default RMS template that everyone in the tenant will have access to. 2. After you pick all of the settings you want to include, click **Summary**. @@ -494,12 +494,12 @@ After you've finished configuring your policy, you can review all of your info o **To view the Summary screen** - Click the **Summary** button to review your policy choices, and then click **Next** to finish and to save your policy. - ![Create Configuration Item wizard, Summary screen for all of your policy choices](images/wip-sccm-summaryscreen.png) + ![Create Configuration Item wizard, Summary screen for all of your policy choices](images/wip-configmgr-summaryscreen.png) A progress bar appears, showing you progress for your policy. After it's done, click **Close** to return to the **Configuration Items** page. ## Deploy the WIP policy -After you’ve created your WIP policy, you'll need to deploy it to your organization's devices. For info about your deployment options, see these topics: +After you've created your WIP policy, you'll need to deploy it to your organization's devices. For info about your deployment options, see these topics: - [Operations and Maintenance for Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708224) - [How to Create Configuration Baselines for Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708225) diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-add-network-domain.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-add-network-domain.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-add-network-domain.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-add-network-domain.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-addapplockerfile.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-addapplockerfile.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-addapplockerfile.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-addapplockerfile.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-adddesktopapp.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-adddesktopapp.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-additionalsettings.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-additionalsettings.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-addpolicy.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-addpolicy.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-addpolicy.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-addpolicy.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-adduniversalapp.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-adduniversalapp.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-appmgmt.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-appmgmt.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-corp-identity.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-corp-identity.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-corp-identity.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-corp-identity.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-devicesettings.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-devicesettings.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-devicesettings.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-devicesettings.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-dra.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-dra.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-dra.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-dra.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-generalscreen.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-generalscreen.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-network-domain.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-network-domain.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-network-domain.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-network-domain.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-optsettings.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-optsettings.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-summaryscreen.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-summaryscreen.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-summaryscreen.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-summaryscreen.png diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-supportedplat.png b/windows/security/information-protection/windows-information-protection/images/wip-configmgr-supportedplat.png similarity index 100% rename from windows/security/information-protection/windows-information-protection/images/wip-sccm-supportedplat.png rename to windows/security/information-protection/windows-information-protection/images/wip-configmgr-supportedplat.png diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md index fc7e101613..a1e662c65e 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md @@ -28,6 +28,6 @@ Microsoft Endpoint Configuration Manager helps you create and deploy your enterp ## In this section |Topic |Description | |------|------------| -|[Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-sccm.md) |Microsoft Endpoint Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | +|[Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-configmgr.md) |Microsoft Endpoint Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | |[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. | |[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). | diff --git a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md index 7cb66960c1..40378b69bf 100644 --- a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md @@ -56,7 +56,7 @@ You can try any of the processes included in these scenarios, but you should foc From d97e167483c82f003dd85d6170c91708062935ca Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Wed, 18 Mar 2020 08:58:21 -0700 Subject: [PATCH 04/33] correcting overview filepath --- ...wip-policy-sccm.md => overview-create-wip-policy-configmgr.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename windows/security/information-protection/windows-information-protection/{overview-create-wip-policy-sccm.md => overview-create-wip-policy-configmgr.md} (100%) diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md similarity index 100% rename from windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md rename to windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md From 7b4c2e0910d06a13e08c58b1e75e7bd3ca55e8dd Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Wed, 18 Mar 2020 10:33:30 -0700 Subject: [PATCH 05/33] png name chgs for defender atp --- .../{sccm-confirm.png => configmgr-confirm.png} | Bin ...n.png => configmgr-create-device-collection.png} | Bin ...reate-policy.png => configmgr-create-policy.png} | Bin .../{sccm-criteria.png => configmgr-criteria.png} | Bin ...ections.png => configmgr-device-collections.png} | Bin ...mbership.png => configmgr-direct-membership.png} | Bin ...ection.png => configmgr-limiting-collection.png} | Bin ...hip-rules.png => configmgr-membership-rules.png} | Bin ...cm-policy-name.png => configmgr-policy-name.png} | Bin ...sccm-query-rule.png => configmgr-query-rule.png} | Bin ...-simple-value.png => configmgr-simple-value.png} | Bin 11 files changed, 0 insertions(+), 0 deletions(-) rename windows/security/threat-protection/microsoft-defender-atp/images/{sccm-confirm.png => configmgr-confirm.png} (100%) rename windows/security/threat-protection/microsoft-defender-atp/images/{sccm-create-device-collection.png => configmgr-create-device-collection.png} (100%) rename windows/security/threat-protection/microsoft-defender-atp/images/{sccm-create-policy.png => configmgr-create-policy.png} (100%) rename windows/security/threat-protection/microsoft-defender-atp/images/{sccm-criteria.png => configmgr-criteria.png} (100%) rename windows/security/threat-protection/microsoft-defender-atp/images/{sccm-device-collections.png => configmgr-device-collections.png} (100%) rename windows/security/threat-protection/microsoft-defender-atp/images/{sccm-direct-membership.png => configmgr-direct-membership.png} (100%) rename windows/security/threat-protection/microsoft-defender-atp/images/{sccm-limiting-collection.png => configmgr-limiting-collection.png} (100%) rename windows/security/threat-protection/microsoft-defender-atp/images/{sccm-membership-rules.png => configmgr-membership-rules.png} (100%) rename windows/security/threat-protection/microsoft-defender-atp/images/{sccm-policy-name.png => configmgr-policy-name.png} (100%) rename windows/security/threat-protection/microsoft-defender-atp/images/{sccm-query-rule.png => configmgr-query-rule.png} (100%) rename windows/security/threat-protection/microsoft-defender-atp/images/{sccm-simple-value.png => configmgr-simple-value.png} (100%) diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sccm-confirm.png b/windows/security/threat-protection/microsoft-defender-atp/images/configmgr-confirm.png similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/images/sccm-confirm.png rename to windows/security/threat-protection/microsoft-defender-atp/images/configmgr-confirm.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sccm-create-device-collection.png b/windows/security/threat-protection/microsoft-defender-atp/images/configmgr-create-device-collection.png similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/images/sccm-create-device-collection.png rename to windows/security/threat-protection/microsoft-defender-atp/images/configmgr-create-device-collection.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sccm-create-policy.png b/windows/security/threat-protection/microsoft-defender-atp/images/configmgr-create-policy.png similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/images/sccm-create-policy.png rename to windows/security/threat-protection/microsoft-defender-atp/images/configmgr-create-policy.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sccm-criteria.png b/windows/security/threat-protection/microsoft-defender-atp/images/configmgr-criteria.png similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/images/sccm-criteria.png rename to windows/security/threat-protection/microsoft-defender-atp/images/configmgr-criteria.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sccm-device-collections.png b/windows/security/threat-protection/microsoft-defender-atp/images/configmgr-device-collections.png similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/images/sccm-device-collections.png rename to windows/security/threat-protection/microsoft-defender-atp/images/configmgr-device-collections.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sccm-direct-membership.png b/windows/security/threat-protection/microsoft-defender-atp/images/configmgr-direct-membership.png similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/images/sccm-direct-membership.png rename to windows/security/threat-protection/microsoft-defender-atp/images/configmgr-direct-membership.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sccm-limiting-collection.png b/windows/security/threat-protection/microsoft-defender-atp/images/configmgr-limiting-collection.png similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/images/sccm-limiting-collection.png rename to windows/security/threat-protection/microsoft-defender-atp/images/configmgr-limiting-collection.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sccm-membership-rules.png b/windows/security/threat-protection/microsoft-defender-atp/images/configmgr-membership-rules.png similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/images/sccm-membership-rules.png rename to windows/security/threat-protection/microsoft-defender-atp/images/configmgr-membership-rules.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sccm-policy-name.png b/windows/security/threat-protection/microsoft-defender-atp/images/configmgr-policy-name.png similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/images/sccm-policy-name.png rename to windows/security/threat-protection/microsoft-defender-atp/images/configmgr-policy-name.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sccm-query-rule.png b/windows/security/threat-protection/microsoft-defender-atp/images/configmgr-query-rule.png similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/images/sccm-query-rule.png rename to windows/security/threat-protection/microsoft-defender-atp/images/configmgr-query-rule.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sccm-simple-value.png b/windows/security/threat-protection/microsoft-defender-atp/images/configmgr-simple-value.png similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/images/sccm-simple-value.png rename to windows/security/threat-protection/microsoft-defender-atp/images/configmgr-simple-value.png From 6667966538e93603b2f49bf6d47a98b06cf4ae7f Mon Sep 17 00:00:00 2001 From: LauraKellerGitHub Date: Wed, 18 Mar 2020 14:30:26 -0700 Subject: [PATCH 06/33] png name corrections within labels and onboarding --- .../how-wip-works-with-labels.md | 4 ++-- .../microsoft-defender-atp/onboarding.md | 24 +++++++++---------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md index 47d4db6ed7..684b78d8e2 100644 --- a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md +++ b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md @@ -82,7 +82,7 @@ When you create a sensitivity label, you can specify that the label be added to ![Sensitivity labels](images/sensitivity-label-auto-label.png) -A default set of [sensitive information types](https://docs.microsoft.com/office365/securitycompliance/what-the-sensitive-information-types-look-for) in Microsoft 365 compliance center includes credit card numbers, phone numbers, driver’s license numbers, and so on. +A default set of [sensitive information types](https://docs.microsoft.com/office365/securitycompliance/what-the-sensitive-information-types-look-for) in Microsoft 365 compliance center includes credit card numbers, phone numbers, driver's license numbers, and so on. You can also [create a custom sensitive information type](https://docs.microsoft.com/office365/securitycompliance/create-a-custom-sensitive-information-type), which can include any keyword or expression that you want to evaluate. ### Protection @@ -110,7 +110,7 @@ You can see sensitive information types in Microsoft 365 compliance under **Clas - Auto labelling requires Windows 10, version 1903 - Devices need to be onboarded to [Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection), which scans content for a label and applies WIP policy - [Sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) need to be configured in Microsoft 365 compliance center -- WIP policy needs to be applied to endpoint devices by using [Intune](create-wip-policy-using-intune-azure.md) or [Microsoft Endpoint Configuration Manager](overview-create-wip-policy-sccm.md) +- WIP policy needs to be applied to endpoint devices by using [Intune](create-wip-policy-using-intune-azure.md) or [Microsoft Endpoint Configuration Manager](overview-create-wip-policy-configmgr.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md index 2e8bae4127..c1e1584dbb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md @@ -73,39 +73,39 @@ below to onboard systems with Configuration Manager. 1. In Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Device Collections**. - ![Image of Microsoft Endpoint Configuration Manager wizard](images/sccm-device-collections.png) + ![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-device-collections.png) 2. Right Click **Device Collection** and select **Create Device Collection**. - ![Image of Microsoft Endpoint Configuration Manager wizard](images/sccm-create-device-collection.png) + ![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-create-device-collection.png) 3. Provide a **Name** and **Limiting Collection**, then select **Next**. - ![Image of Microsoft Endpoint Configuration Manager wizard](images/sccm-limiting-collection.png) + ![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-limiting-collection.png) 4. Select **Add Rule** and choose **Query Rule**. - ![Image of Microsoft Endpoint Configuration Manager wizard](images/sccm-query-rule.png) + ![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-query-rule.png) 5. Click **Next** on the **Direct Membership Wizard** and click on **Edit Query Statement**. - ![Image of Microsoft Endpoint Configuration Manager wizard](images/sccm-direct-membership.png) + ![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-direct-membership.png) 6. Select **Criteria** and then choose the star icon. - ![Image of Microsoft Endpoint Configuration Manager wizard](images/sccm-criteria.png) + ![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-criteria.png) 7. Keep criterion type as **simple value**, choose where as **Operating System - build number**, operator as **is equal to** and value **10240** and click on **OK**. - ![Image of Microsoft Endpoint Configuration Manager wizard](images/sccm-simple-value.png) + ![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-simple-value.png) 8. Select **Next** and **Close**. - ![Image of Microsoft Endpoint Configuration Manager wizard](images/sccm-membership-rules.png) + ![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-membership-rules.png) 9. Select **Next**. - ![Image of Microsoft Endpoint Configuration Manager wizard](images/sccm-confirm.png) + ![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-confirm.png) After completing this task, you now have a device collection with all the Windows 10 endpoints in the environment. @@ -123,7 +123,7 @@ Manager and deploy that policy to Windows 10 devices. ![Image of Microsoft Defender ATP onboarding wizard](images/mdatp-onboarding-wizard.png) -3. Select **Download package**. +3. Select **Download package**. ![Image of Microsoft Defender ATP onboarding wizard](images/mdatp-download-package.png) @@ -132,11 +132,11 @@ Manager and deploy that policy to Windows 10 devices. 6. Right-click **Microsoft Defender ATP Policies** and select **Create Microsoft Defender ATP Policy**. - ![Image of Microsoft Endpoint Configuration Manager wizard](images/sccm-create-policy.png) + ![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-create-policy.png) 7. Enter the name and description, verify **Onboarding** is selected, then select **Next**. - ![Image of Microsoft Endpoint Configuration Manager wizard](images/sccm-policy-name.png) + ![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-policy-name.png) 8. Click **Browse**. From d3b5be61ed479938747e49fc4fcc49a2612d92d8 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Wed, 1 Apr 2020 12:36:00 -0700 Subject: [PATCH 07/33] update & new image --- .../images/msdefender-mac-config-profile.png | Bin 0 -> 84961 bytes .../mac-install-with-jamf.md | 6 +++--- 2 files changed, 3 insertions(+), 3 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/msdefender-mac-config-profile.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/msdefender-mac-config-profile.png b/windows/security/threat-protection/microsoft-defender-atp/images/msdefender-mac-config-profile.png new file mode 100644 index 0000000000000000000000000000000000000000..9106d38d7e7be362864901d409d53191be7a61a9 GIT binary patch literal 84961 zcmdqIbyQSu+cr!LDF{QC#1KkKNJ%O~h=huiq;z-p&_ko7q@Z-j&>a#ZT{3h_r*wat z`+lD9xqr{Q*7x_jzQtm(_srhczT!NO^Ei%c1An6;Pl!*0kA{Xu_(}o#4h;?KIT{+e z0WJpc$x_>@A@B#?`JMbrw6a0EP2dD%{zCZ$8d^o{gX@o2z&W0Sg0?dn+QXmszvw;o z1tw@{ci&$@U%dCw-??#5$@pFICw6F|_24?wvqiw!d`~yb`;kLiH&vQRo8jkZbXwyd zgf)EKt8`enOyJ-*P|@{t=fQWJ>s-~(furI5qs-qNw$1D58nq%J$o+M0GO=8kb{ zTwNy&el-XKZ_YgLPV$1-#;i7S%`?%*FjAV zy9By0U2`=hvL{?}7Fm&g9(CUrtJ+^2X$o8xk_3MtPptMPq7%*h6rY(IsSxf!p|W+^ zZI%%EniFw^-#3%{tMoeOoqmGE)x-TMe-=^hO70-{x0YC{zFh3wVzob-5P1dP#04d; zI-2wTxzG~Rf(3npX1eAPob1KA4NkjZS;t-{14R11l}Gtm{uRb&=rJkeqOJ=WY;l-Q z5i^Cz=T z#3Ra5DqfT0A0wnV1djwvI_sEwK79|WE5_4?Td7P`Iv&NK%gEbLR{5^hvAbaZ2ysAg zjLdH1uXdM5AH3j498Em7DYmwl_kZHJ)qimj@_jTu&!w|-ZrY(}xq9Q&GV5b5+wu)| z%w&^oa?0@Wtv`#%$(vQZ8mGD8x1>pBTEec~*G+*&UXpgp$K830#xm?$--i;XFUM$> z{~5wVkwEBW4Ac#NtF=Y7nCp9OA4vwC?ue!TFkQ!C@RfAhNf`ahAy@ZP{&NzSLFHK+ zI655uYxC;iBQXya$KPLqcV+{t`qTduPdxr^#t+FeTiuaz;o@WWz1TXziKPoGIrC5( zt4uBUtXBDuPDM$jFI~j;blcwjBa2+tuXN5nO?#2d^oI<=wu&Dn2Ip`_`JEp`D57j8 zo4n@O5^}>{#gP{a`rsp-6l`{2Oe{CMbj>HSVyX_4gCGwI?_6y4^=dYS(w% zSPn(s{u#A5vp_ zjA1aPIlH3Ja;I~%yyfOaa;$gDU$gbthO>)<&+|`P4{yzzvCYi>aO>C5(Bw*93omTf z7@zrJ+jnnnI#ck5seTd4_b$I3Gk@xlf7CP7e0{p^i=Ah_#`U2gqDj}Y{Po!h-VDO& zf!8tpfgg%Kqwz$m(Q*67ThjUcOX_;BQ`+9larD zc-}oAHY(u!SSeM|w0pMwXAk(`P07ChIrRyh&C`cWjC0i zF`0bkO94!|8YS~uTDp=Sdu{Z`w2vs1)A_HO?#f#JQJMS`CHV7eC#Rye2`VHm2`-z4 zveTO&a!}&D;f71L&{Nd>9>34=x03Y03Q}|4V20O^icNskvjoR)Hj{4Jh_UMbG_s4u9$*Cq= z&3B63v>6Q#9|^*kl0++=QS{VPo_bQd17r=pXSV>JFLwM_rruuX94HGzzQaP$($P=?+@bA zsm^3xo3Ey=d6p$I(u@lDgy?1EoZvUs)IcRAXvWYByAE7(J4o)0sIFWBQKDHolaT)9 z7nPE~bcA9r_0`#qSd;S*O!6j-oGkeW*MNXVTMbobe)kdI*pIENgSD9Ei%Np}`=cE( zxBYy3V3`UEihjEj$FSvXcoRo$&$#Vv|9v~Ol>0b_O03>|p`BC17Rkv){mh1IVD+$G zLHGTKhyH_srfTMc>&5{v|Lwu%O>Ix$DT(okJ#~^+vk48CUiyE4ba*F#sPBp#w2?CE zUj-16LG>51_gB8_1ke8}j4|}7V>&xF-L7Vq*s^BE-D`QIkBf@7A2Ph|?H}xW%H?_b zy%sCdo>#MZd-KU1Il5uP_^Os}=LnA!LL=6F+jCi&cji~2TvP>#! zA}ulDK;`<=M^ct-jMvq)wK4Qk(T>e`i*Lh^79*3&9!76VcoA_u;YkzsW3Et0N5!YIA7fk$0`lg71a}$<#^AWs!u=xfj z7G!c@{LN&`Y*4pCXz4p@;dNhsMx#UOyq-aw3pwWXvG#-1gVYKfB8D^|*6Vd*GjBp| zCaW^q6WJvs1d`FO2HYDInS^cUutxu^WCFOzQ(W+i^GRx} z$Dd_W>pZ2bvt{dje!b7*+-Xccx1SQ9Hci8qW#pAs(rR}n8jq__qC>h&o!6e4zMpSC zTU__WInq6ee%!5^+9i?^pOL?h#as4NtI27z*OlO>cy4o}{s;YP$&a)GZm%q{R`vjJ zov@q4&(}GVWc}W5@RjzNOMh=QUetDwe3Y@Sy^Umr=S*3=F`KhQ>kl$4>FDj*(Z+4< zdaTd+LmAJVB{PP8aqj%KM}9T_MO(W=CF+Lgc16^!JP&%VATx$X|G8&rlL{3Ulm5f~ z4m`R$>m2Y=O!#m9{z!VQgJ>c3xy*hUPHW@*_$&aQA+I(5kSDR^o9+S&S?~?Q%3b`e zB;wMO>6j8!68*obqOLALGl67U(`S%A_DPLu}*R@ep%i_Gmz{LBK(8Fia{27pWuPfF;fL!JQTx%t$MGHUU`8CMBBj(WA zs3+MK7DJVlW&q9j+Uxv4G3Jq~Y0kq(n{Xk!>GrDG#yj4%)3?U?CV$8n#cU@6>6>x* zs$;07s;hFIa|^gn7QjpToBK4%bgJ!0WllN^D~0XmN5*|}7P7%z-xEEtSaZ9Tcf}me z0eX3L%+OsoxJocuyl>d;w01|B=Kk%Qc`UtDB6VHMAqevTC^8-ga5b|N2L6awA`+Zu zEA%&P%4wC(L+usu3wlHSgA5`zTvomK+MZ_me`Oib#j3jkdqsHNOrE02e4 zo;wD@eA*UA#GMZE_epCgDUuI=7!c5jdQ48@eKsFu_tErx*ZG?JEK=p9x@9h%SwFJ@~x>ig;CTqq(?1K z*y%85G~#E^C;UKA{`hJ-|2Dm3k`f&a@=t(+5&hDlQtK5FYu-0=>gY{j2?1d~(db+c zO1-e3F1|Y+R&M%C8Pp;!{cE<3+caNNZHOKzBcyOC8#-1VvwcrasPAUHFd}n3mXxU{dboF~e_zz_g{qrv_!00_qqs{&g9qWq9=D8Z}c1;(p$tycV z_+%x?8(Wk&D`gG-w`TtL7!7dmFXaC}gz#Kr{r_D;*mc&iIj@ZG(!i8*1M+B=`3}w7 z_`v=LN*Elb;`y9jK7WLW)+w2q`?o%-mEdWiKwb-RnYq+cPw-pw!DgumirS{9#j^hi zKzBvJ2(@t@q53$j-;E+ZsR?itSa1mm)FYbHemr zd_@cP8RGSq9=AyJCKE^5RSmysm z^7$R0mDNW1-7dx5Rux3RQ#4TOaT^KRzrJPZKF zf6LpmnU|5{ZT)e)qAJyTxMm=6QNAu8o91%2Pfsu6aUPN>3(T*O?Np2NSqtJXhgFKW z>)JqTlkY`ub@agcF&OX?jAS}Ao;x3vy8qC>i`22dIhnijxx6@`tsT$0Mp{P7OK#yC zc;}8i^>;;OF?bstjwZG??Z!BgvY~{9&KN|F&xr0Uw`259qHl%eoBqQ9@LY2Ud+j9{$OJ(>zJ{y&peb)%5f{UyybMuy3GGib?v1e-^NMpyy+E7$xaDSYA#(@ie}JPW*|42?)#}@oSh>y(?MZm`UiZV{Euhq| z8a3xVj%+gk3Yfo;-Fkadcy~Q~x&KDydu4d8YR!j@0$9 zr}mA``?oT)pD-x(O#4iq+j#zJISVRoINNA;97`fEMlE=r*}tGdNnL*HIT5~fTFEOF zDl4WU|0ja3_c1$rMP{r!W;lk&o6QHZin;AZXO>KFD7}cwe z{?W01jWaJ#Y_COif@V5~QV4d(j3Yj_Vv@t*-aafnSBG z?3Ssm-Wwx87VLUBHRuPfjz_(akvChX(2`5ncA4#DKVAaXbl(5KLR(hw-S|TJ-SFcq zub6yhvCPEJtrnXRztqh49?Uxtg^orPO*6yUX@%`qraZT(E7waG>QWWkV%gYQPgK_L zj{NVOCuT!BJuhU%1%zw>97*%&o_nPmk<{2cen2Sdb9~-FnC6LZAujd>VBL&^ zmG*NL-V3mw$DqIlz#6HsJaU7kbaxFs<n!jUm-M2G#( zPmew+rwVbhatE=grb@04$FC47KbE{bJ~EiSE)E`;IiC!DmE=k*e6;kUoy?K}?>~|H z%QO)Eve^@9=v}4W9FHWnPGEs zi`9UaX2cj^>n#_331#imnDbk=_qzt3?tL>rcF-QiusK5-RZfugwE1thZEH)~ZCvr# zm7c=!-j$xe!=K+a{yrx|S-wl;*!zup7q+#rQpLsgMjn29A)5C|?dP`pwC)60s>5$T zU#FS5&L)Ny$l92m_SeiWD_2UvYVXsSq907JZ0?)I`F#LBZ}Rd zu5A5UC<=JJDEHg7!&V9S-E!WH-}y?`OD%*?^>fBr$L4*?Ao$y#X8m8}bBG%JUWT~O z`z}b`UhMc1UBi;$^%-_YQ7(%Ow027;z6WRiv-RE#nzyH&tsV#acL!U=Wi4f|QK|)T zHAIgjzcACHM%F{FdZe;0HizsMb7M|^qr^z&QsjnFq(^a)0ero=)hMSLG3+{`!mB)m_a~f~et?P81 zuWp0nQzAV3;h*!%wObEMYZvlw0WYazf24TfzM|&6S-ZH1Oq#n}Wbp6_RcHHXc7At$ zSt}P!-D*1XF!Z;MU2}$IQ(4Q$$#A~@f@ewS9(#dZO4CsrG}>a#C@eu*pqP~R4V5>- z|9*NWu-9}|tJG@WawB>3i<3(`>&G8pUbSl_m)hEMWkO@3d}_aI0)A^gK{L_qZG7RF z`4Kr%nzQ%OG(^jEi@QSM@@O3KDzw9 z>wXU>`>uPv=~=0t?>b(W8ywygr?kD2u<8%ax<3AZq}KMNC8@dIWl%M6UwMi{K%=5c zg}OuC-A=c)|MYaDMOklcd49L6KZ((HrZ{*j?6>^h>gxRSP_eb@RZ#dpq0em)&B$#Y z5Xqyzw}s|i`pR!_WAgz+C?z!l{po7d0N~r;>O}!<`rm~~eK%h#(aUO!bL-J-74tv@C#K_WmB82+t#|hhQO*$$Cde zv{?YoUG3dTR5AUO=c^gWY;2P=ir&V(-K=OuP2lYJsicb&YOnoLa1Pvmczrn1BWlQI z@+qCy^SRm~>}OA=&sIIK)B>#BubF+b{4h`EMVz^UEc`xhlB!DnoTa^Nbaa>~nehOM zDlf%L9-d;|CYvtrjK(?NeayR)-Tk{O|Lb*ohV!3!++sVWAI_sDT3c4;7iRCSHXI+x zH|(KlbsUmf8`NNrCgdwN_AHhWP-nB;wz>I4$vI_vKAWc-+G z*;efI`frVx8%lkz(uTaGCPL+bn@gfwsk<}UwAwwxhL+9b+Sc>G+x_d~4&tI2$>;Ty z`s|LknN8g%<-RL3O~g{SzpA4y7wVUL?R_5;v#3E<{v9CQ=-@EI2G~xb#j>RFNC_oOUhiJ zNx|p*R(>~W3!ax#l+@jO4QIFGQ8sL^mJMcoXe)V+PW8^NPk}06OrkQ`XQ zA=PqQI^|56!%Qb1W_bq`pStayEWXbxjDHdZdt&l!rV&Rc!eV?xQWxWu;^pVWDP{g= zVe9l_4ocV*KJ)}7v}fjPd4&x zr8;iCyP>5)0eRic^(7@?dNpc$GgZ|8e8qtNZszkv2BC&wtKN~YCBrSXO| z4O?Ile&rrnxvY8AXg;LZR_6z(#I>L}qBODn`nynrS+AeUwS2$SGPe%@)Au>6bi*dD zJi7RK5S52R^qBt}tId2U7p79xO#f7bfVSw0*YjG0^Ml)q z_4tdJ)J)xNr&QK=-k3b4G;(L%d+F73G{;%HKdbguy^rO3_@{rvpBk}GWBk-degNOe z?NKplTT#@LA;kjrC-~fNmpT1?27+4sS-6?yi5@bE3f>&HO8#Qzz5dMevF{W!ESB$G zZ_WN}A9=#Z4#b)Hu^M5UZ597mCVZD9*Z2Y zr~N~iU3CeOPxIRP#cAu#1yN)z&zw=&i=Gm(Qz&mq{v(MTc zm|~*>l|H0Vqxr(utlR5QK#u1`Z+p2v0@I=Zx(HRJN{q+KXOTO*J85n0CeBRF=&8E} zHizo^f@=B8{zb+0eX$GBVm!DDaDcD@3KBjtY4GmY9MyWXhcg?|q(9($MR++#uKCyN z5NS?_(k%J#x>o9P)md`uJgzdf0l5IS@ci|kih1v*M1rbTWg0*NN3$Yed%oq?EFakY z;u8r`nc4X2m{F1X!g_trxAx|8?;fwBw&A}lm5N$@7m1`=_wv5?X|{`ch&W#M*Xz{m zme>>AVqaO?yIjr_l^JC&RJoeV7z@atgzvT^I9u*kQY(Y}p#vn!?0g0qf`Kjg^?sf6!+eR#x1meUqvNSSKc*43I07uPR-dZy3%9h4{sPYs$>kRW z5Dxy)slV=(@Vv{mx~4&+^O;}G!d1H}{nfTqjom^t+nAWE+x|#nNzPj3&@h0z)Lr2o?>!fn8YkSqvXE%FZfE#ioV%)84Vy0hZaslMCd21s*4a)xZ&#pKM zaE(48I5oW}e~Yn>qfN%ge`@Ahh;K+EmG{=Cz62Cz{d7s7tla>Z~tqK=w9 zO2e^h-W{a1Yck!t?jlrfPieL|bXu#uV(<}>5D3FDNjKgx5mD+x*6=;enF=2Vis#{a z&)ru?-;QsV_w|8I=}VDgM*SXa;RYN+h^GTgkZ|p+*VRIn&m~ay%plEs-8v8Hp63aV z-Xj69K)yb?xzQ73OJ{_x<+e?^6iJ{|*T_ET6-s zEANI66OPmD>TjO<`;K;>yizl}-kDC@yV>2pJsht*-nu8V3z_Gdeji_XnhrP*wf>F1 zyXMi;t1{`zMjCuw`TiBK)_44Y>JHBTC3QZcYJc-vuNY;w$g1$F@7i+J{?=Mo%I8>w z=yu3of|3T6T&i_+cX@YxrYf~PP`B68B7P2_e|h85n(%_3s)+2~Y;)G7C0o$hncu;R z!JOk$!2p?TysE&^;iOzRdsP9T$t*OJ%K*A-E^MPP`Ld8!*tYSk1;-zdqla&MZ2VW0 zYY(}6#~`DZn*QST&zULFAT{8Pu8y_c{tx|@G*w!uXA}0b2+O{h zoKH?QCa)AkqI+&Q>~Ie3kgq~pkNlS zm5vv15PUl(J_7D<=5ycECF57C>TYK5GhGgbm*J%_|c+c3$30w)BwNjyw=_NLrD0PIUoQh)zBvI(elbo@5s0R3xn zvqn8OS*HN~`7Jnl1PG&(oujUA>|+4619bwfvasEB!+smMIfkssbY>91_`gV#_#pE? zWLyUIYZgWbm|N${kxP>__Fpc*?Gjk;UqAW6Z+i+b`;v8WN)wtK-Ky|FOJJ+0hn-pY z@6d^iWM;aM^Qky}ocUCRb-8c2*FTiBXalzE6c#mVXfD-%i#BM%#0`gOITUGcM~mDD zA?4k#7lHYSYU|{2>5WggrYv?taoCD$_P9mj;vv#=qZNS;-ywh9%EatB%VVszgYaMM zyr)e3V5&85v5qYJ{IY99!96HbKI13F+^=V+zjY)n@wcb@FRe93Bi<<{Y!ucvrR?f?JrB}i@FGEJ1wKlIK0o>!|b zFeMMVPx{j_JSScWcVf+it#@NE(_>0y_~6H4)?mfrWm4N~P8}Ym7+yInv_1LZd#?Ev zR_}NqVyJVVmThlHHc4?!wn0mURf8pkl_`T64X=F=i&sN*Mi_-L6Xu?d{d_UiaiLA4 zU0|gJRvKvD?Te{{H56rlAarS0^Pu~|?V)tgUuSPvyqJ1efB;rB(6KqYKr7SWO+vCk zN?Om|Qywl3OYH}dlbCC3=m`;c4^s??HZ87?Qzc3P!fTLPa3vBW+ryIMey2@25hk z_LAlTvryQGOo&)wRXr>oA!de|+bapjxt^e*dd;GNiOHXzk5pmhqowlfr7{_goRiMc zA~c~Tf!i4d&)#CMh0x$ixnZg%J!*vU^@S48N%JG3Nh}R8S8l?N)a?wR--3kVq8^pP zY;+vFPo=-fJc~Q|WNY{!=Jjgvd|S>kF?}%%eZCAE+tfgV&}KI>jClS9O~DI2il}X6 zu(gd%NpW#;VPRo$F*(HA!lIxQtIV>X-2K3Q5Y@8OU z*o~`;X(7TEe|h;FhF~;C)6Avhpq=ENAzvD2Ehb4H=107=tNxUPFn!Ef2s8DNJ|z@a z!<0QG?3}}nn6+YkYl^9Dkf5$5cCTlVcrhHgP7lK*-ev#1kHOLVE7rs!wPk(xTijt zc*YtSRNPMbG+O>%_cN9YiyNwjf%)_8rp!^&6C2pe$r_kou%92zv(i!vnqjDIx zXjoiC2+0PEBIAR(A#xOUCQAV&lx46uWzd+c5+izcnYAnD(tAD=B@-n|zFHDZ z=yIp6JtIiECW0AHbqVr7lWydIkf0wKU_&lXlG!0+5*RL*M)L%r9vH#_%jE<$Y|s{H zK_FMy4Zt_unhh`#mtO%d!-IStmPMvWV@St94JC}Hl1(vXOr%xFaW3d|DfwWafQGV@ zlD_UmgAa5=FBzVzd#a>`LiWrmw}LSr7k zBp}tTkk0rL?qK>>PBWPNK}1Ybcj&eTXW|n#$CO1m4Y@!Kj<;NXtMi(*Fc5D$^DNr? z|Nbb`eldAidN~eg2{Nl@8U_vj_$B;bZPnWRt0~Da>X%3nCK8tUTJWSZ17KzCfA#MHpncuSOZCloEa91JDxc~jhdCj%dH>E+csQ@sW?{3 z!qQ;{%qmou9~&dpRsn>7R&^Og;D+IqX=SS@Lp?Z6jY*hz(;4-Kzo_n?8UKb=O9{LLboaq{A)HEuxY9-m0_s>v_l2W}LSNQFCmSFo zPZU7nA39l$8RPW8bNK2I@efcDrQ%?9YCI*VPL#B1By&7tkE~^Oe8}tIQqGQuKxmr| z_+yteV~p1<|U&JthGEALjK?rWjPZLb6zk0d#`G z!jW8->e)(*Zm&g5jF#|;D@yI)y6Wn(QI7aA@cwv_6buJsiE=!HF|i8TSY|4BG2E~S zYNC;tUm736TxM^Ni<5xMDWcQwfYhy0On94^l7|6zSQUC>vd|_3z$=|>^4wP%Dg}{5 zVl*Sludo**$!3_cp@j&(ni96a>RMO>CjzRqBKQUZYWN#BYbYSLW)=@G!cwGgHI}z#Zz<>4GU^x}9`zDipW)+CCe}%la}~ zr`O^On-iF(ps|+|Y-$n-C%FA16vs>oM@h$Ywkxf^6dvw1`^~MMgW!vAe|q1*>)?}F z+9zO*B~Vc(R7?5WiZC&T4)cT7bHZSIND13ta!W?OZgwCW<(Ccd+klLPR2JFTEN7Ipr8na^PP_`RI z6xb*+PI$4(x%EAS*PZ6QcBur zwUfjRW`59vt2@h0%Nra9WLA_k^#B?xWVSSz+fd=#i6SrTUt@SL#71o0Ov2n~`nnU@ z!G}TV-iJ-F!~`ZF#(XO$APuK_hyzNe;$<22VohnAko}PY;h-fAuhxgh*IQ7_4Drx0 zJ2=+bNdJ71Bg-pI0KI>P(LJJJhC-uk>U8kffMF=D#woZ=*%ktW<2F`+ipVW4+f88` zG4gSuce0FPbb*=Ta2>0{kvu$L(@u~gh}rEI6@cXqJQxj-5tBfRS&ol=vZf#+V9IcH zb*bB#Y4W`=NS-oJM1;dYrQurLare{o|8XC2xYFYNvLRVsE`H*ZE+GeF;(Y*DL@|LA zqwx}O<#s;tAybfxx*!+XoL``kI`xjE$X;A}5+>r*wywkx^7vQ5ZLG!tT1xR7QTNYF zfuu;o4LfY6C&^tZ^MQK^CgIWg!*L{3Po5*420!ilNuO#1n^ zo|#R}VilH^O;G6O^KrscN4i2Lixfo=ioDEW92JP_E|=*B+~7B?;ONL{=>reKRiwj2 z3bmeYcQ(jyoqGKlYP671l_#fSjtR}lG4bUbBLaVkDrYuZ_ER-Xls*=3@F(x0=-en zh@j)fI48F^ROsYDCsWIZ$VZ}OdSjyVG1U}(+Axo$;N#DWN>N#X2Q(6nTP23GwE%ZA zfz^#r=-Mml5T`2KY@pbd9CCm~KY)0Fy8U*lLz|oVMHOyd=|Noh>zMy(z+f1gBRAza zIdI{y@UVl1aBd3lnhOQGxG|2ZKub<>mgP^mvQbgmav9yE=u)wSCf3Did@rv* z(NdM$Xm%n~Ovej#;G7uqUjIU1KlexE4_PAE(bm62k}`kIQ%H!!N0V&}{+#lg{NrmS zwD5Q)8%PS2td5%XB`a_Hiv$G|f;UryVg2N_B+^~+FI9@6 zFgP*J#RpqPMz&!NCNwhiO2zjza5NH9w5^=~YHHVxQFAtmM6?n63vTwZ0#ggj-~%Q( zrV&QsTXaS`2c>gQOGZbRsR*VAJuENV$c1yEEuGjjsijafK9~mHzc0bEWyIDNVFP27 z0bN<9rQ%2<58|TxjEjEXa{VfeLbl>8LR+>QEfM?~7sjs$dI($IKw!cPuwSwnVrdpm z8?6_^l13cn_`%Y^l$esyle8ziMHivNr9!W>&;G~x`S%%V4b5Qg3glNsmp&+3;@kYB zw{;+8keVFUqC*tH{2}c|lI{70Rd(9{e5@Pq*1QMOg;OxeL8(I;Asu{BM$#XFm9DZS zB+~sHOh2MR-3zdbNQhZUs4JsFNgcY#(cddQH+?1^C&Hd1f~0JPk)S_rGXfg^Ga~)3 z|L)VYvvX4NQqo!a6j$H}%3>ak+|gK!*bv52EgPIN#2lUmZW(1N_!3ydX_L$B)#0_Qqrmf%r~Mf-ZFikm?RrjMTQ? zZm!(>#^_wzuoXdUbu~<2;Fc7Kjq?3T87@#VfUHtzq*0gxu?1?gcFM86k&78@hG_`N z_ZBEBjX@LM&cxwb_useMZX^`PXf|adD?o?fN09TxKdprYQ0b^+s6EqwKgq2z2WkYL z><>3VV%`tIoQpOguUCBphif1@tX7QJb|xw^)avjNEx5YS^J#p0St!8!pxx6a4VVp( zqJLlBDa>m&6~NYUKO6K#-(&>e=x9QztI6jh!h36UOFALOz?`JLO>|%lF17(k1jsH? zVT={iiL4x!vzess1fvOes`~e(z2O?@qfEkvGbdvwh3KcXo5&_Ur@sd z6J($9G-G2Jfp~bFTv!Ffn_FyiFp&in2v`j)O;pSKVa6Ek@F_-u^5S9 z7ew(;se!D&lhoSOlGFrzjRMA7`zaoq1R4pHo0gZk*& zg1}(Qi%=NHBJS95IX;Wky+kUE#Y8TWv>)q%V$if@V!;X`kWO$a1wsdoEP}2IMAVs9 zHY5@U927yr`Fe%GSR{^FdRCA~wsevALg4^}<}l`rj7oF8hwBIxLtP|31dHT2qSJ1C z^2H?7WK0*yS)v83k`xjcCPER4%9RagrfGpW(mv7s?_=&nt*OO;lEsA5?GfO~(PK0l zW-fh_x#2oB5-PznFC~+)If%8DmOvyGQH*x10MoH!)g56D!bAibG!TxT#No2#Ibe9Z zIZD5WBllLG5UbD?oMT^N%SCC);{(a7tqhGNfMA>_kG7?lUSZS3z@xygp^53PnCPMq zLy1_zsK+nq3aX~1F&t`l!n-XYz-)1^G)Rb}cPnc+U{F4e39k|-!rjFCR%S9?#3hIY z714>oMT6@h5Ot8=0v#%JHiSr-LcgL`hz=_gKQ>aMZto>FAJ_pIfwuz*?*hPpijh+U z7DlGxFqq&a!4q9NxHQ^(3Jrqm4#7CI7*3-^Vl6pj zhc6}{hLQ<}NLjf0OG9d=2dz7_NDWG5kaz*}Comf}1YzW$*?EtlaUljygk*j%Xv6D) zKDF_`qyUVOCtzu%UI&&Aa5gRpx_ckR!hizT8+Ul(TgW1@bU5A*Wb*_~I6K;7v{-Gp zNExoqQc))jE`$zI1o;uE0k?YvrRH-0PFi3l z)MW#(Q0a;;uOYqRFlQ?W~3}(Rqx)5I73|ri_%0{Gwn~rmng0&$54M?yO zo+116;+Cxg{G}+k ztrQyFwpa&QjMJV|EU~Exf6)0}2z!bgJjI=+b~cqOD}v}5!3Q{#1_azWB^T*n5}OOO zob+bn|c zF>WGZOuM6O+tU&3munlvfLMRS8YfCJ^$xfpg)o@;OId+UjFHC6MKdS}xJ?!+*UK%I ziTlif>mAY((gGVX4GM#1!;Ir!PESi4F&lfi?Uc|WIlwVc?6>&w_2hHX1ThwDPG4z} z6XY=L7+L&_zqA&nK~F-EvwsOY>%Jp$X`dhx33JGbf_2R2q&d?{uXc(+_YbO3(YT>D+PzPbBF^v_c{cMfkS=pxTJ31!nnQ8vd4Dvf(q5K3od#=FkQG zglqd^hE#Tiqlf$iN2}N2hLToZV&j`ff-&*Km}!a~zyy!YB+jt0FCcZVyMrV9<8e!p zy)c;`JT_|SeGR1}WfDR--~|Fcp5j1Pb;N!|N}W+Z(hk%36QQ{)CsP~CcSS&< zSkzgRbacVE(zPJVRqx=S7cU82ex=;!0M<%_nb*Uph!4=8N8Z9z0#gr6qW&Z2rXr?VL+&w2%~Hu;W#hfOSbDlMjqfh| z959>vl2Vbfc7`rfY@-p{Ug1%+Uvvyl#j`w-_q&TchqugtF@1D*#YGvBOs|T-`<~ zhjCzFfJ2r&gcHp?q+f$vX2Mw!lwKt?k z*uqY3E~Mm=wId>&1f3%?9*;M0LowkC8YT;N1vW;6QVCkRdL90`qTnz&SiTUCSK25p za!MLWRq>8C)m91Y$bykWMSSaNV_0C*1t_DOaS#U!xjkzS1DcNzu)Vp#gSsHMk^U&_&Y9PhH4P zy6Os8!#1q~1v9BL*_?FOJIuEwjk{KiCYsQo1}-WTtW%EW)1k>M^uvNFv;ZsGMU7ng z4LAkf7G_h&X~dWphW_X9$Zcq4W%bV5qYsxC1)gd?6mpYL85 z%bf#?7|RIg(dtIe$7t=Es~rs?3O#t{%`BjMq5&>HlIXDdX~-TE?AN8|gsEE_A z7MRy*N+Pj*pa^f#BD2r^v9QQ3&xTFQ0e=QB5qI&E|kK+Ljmf( zJKlu{p&l%ReULFZbfr&-%po@pbK&^zvxG3 z&mou`6b%zCUK^Si#WN>&BwF-wM@eVbJU5Nj#siqL1}=}bPX_k?!`Yk1L;1FU|h%F-qyG-JzDV=0v=i9rTqNrfyELK`L&QYk8}l9u10 z&wW4N`+lD1_5AVspaivyq5Dkj`wn053dEOp#>f4lmE=vR;|#QqQ>wvDfco# z?hxl-!^JZkb)u(sH(-I}4_$a88&C2JiKW#Bdcq`WBo&AL5-K^UmVJ25|n#YjmYq3nW9;szGPMM^&>zsF+ zn&!5`qiBp-8M#=~<41n@Eyx|ebV##32|y`0=golv4wjh^OY0T&bZYOYm<`4d-APNm z!Ai3fEmfY)&i3zFh4vfEEj6t6>n0UC=0&W#O5-2?%|DcmLMfxVH8H=0gp_d)tkieA z5n62WWusiqFx0t3g2zEYB9bcZYp+~jk3XQMe1?JDej_6lkKmyE^Qf`2G9}q^Ie*Y}z|ikDoobb1_C0rmNc@;`e4UgUInfSz(^ZkL zb$hNR0$-ADf2E9+c${g1HuQ4yBeY{%byUp^;!EjiY(~0-8pJL3?PWrSB|&jY{4~b< zXc=s)9!W$TtEz@aTI$xb zlNtzl8R7P)!_F=%$7#vwkpy5f6($b&D5N;#%a#~Bpfp(1T&FAVDE_*XOTC%}Ei|1H zlm_JZi9yd>&afGdc<(|cuocwtd#BuY04#Q!-X?m^R&7Fkl$Z-B!4edjr;Y7K$@_@= zYO`B1DwB;Ny+yW(HW3gM?>j#gZ6WH)YolnLU;4cUVL-MO*ouo=)S?d=p*LXi+G4J7 zJuP9N+0#ClUK(>+0EryUul{sACX2DyOKy8sZyaja!S>8<36Kut%_c)$3xqMQxg+4$Q;jP+J9d0*hHV zYK$)V+btmDa3rv83KdjhudI2OSd&7Eek08i)qgs8BPpxJbAXuLMlTGP$k6X{~-9x@`!9AC~4=ntu3y$^$ zT-sO%WQaV2uV;u9YW?02O~TMPoGxgu~EyJs5>+% zySys3#VTmChj*pZPSG$dTO&)JkiK6p)bzT|-ZX{le&(gNQbHm@|Fd0X)q|`by z5*fTbvL5P_LW<^JX07F%%)~UkPb?D&NL1rFy5+i zjzl!!DB+XoGN;UY7t0;LJPZ(xEM1XM(4sZ*C+~Zd8zIXOTZ6bb*uu98J+Q_mV22xz zl#FX26zxaqPvCA6Jm&OSD`YZUCJgq)`Q?qLd0J@*MP8-151`Bl3^nS)fJ`Oa2Pc+4 z*+NL6fEcHOu0i||vv--Aw)ZfAtI#A#&yyW6bv{RMNFJt7*}aiQ8`<2*ZyM31xH+0asXg9&!d)OGFoT|=5&;hs`#CsVxa)rG~cW|iyVDS zxw$Tc)YyBrTkg@kIg#Vd^wo_Ick;J8^sHv=QNs7GpQekl2__~l2Cr?1_~qX5>X?+Q z8{6h|`5D8|Z)>W|FSa^*v2xhYLwpBCs-9eVeRhXO!NPg>Q10ijw=-pi(PeR~DtGi> z4=Y`9I48#^MyFyj{_vA${+Y6FQ<8@2CGPJxyPom#@bR=$C`)GB&qi5LW};9T8P!%9 ztG5sOXndld8TxvuHe#Xk#F>@hAGXBCkRuEvvL(~HKc{!&Yl`Wj9h5^Ulu?52t@XN9 zrPnL8HTBl(T^~0(U3$5>$Z%6tLx~Ba;f7_TCLd#juRPM#WXIJczJi9B-$B-~xz7`)u#RG5SV2%8h z{)i}Arq)Cyp;{~f;+8in*M1nKSjyc#YCl^!hE0H=z}hU2k5zG2*LMP9SR}|8!#QCD zNgTkeu|pB!f3%GBqrX0Wfd*Kc;b4LxqwBFZ!|I)dP6>!1*qI#CsF+;**h2z6)lQXj4RgNK&BPo)( z3=nU8GeIYLiPI1J#ra@nn~kz{%OkdH+$O>veYBoBkw~?QwdyMZwEka5B$+rXySNA@ zeXVloPh{?X1o zJs&Fl{fgVl7E`s==hf9*?Ae;if$693O+FW8Li%-i`SyoRiP{;-@RVoWG>?gG%+WJM`u(C4as-@6ZPa^FKeXe6qFo zKcMemQx;Z1ooFYUlwZ7{x@8l-`1{(sIZkzi*EX*2IivRRtlg0Ao-V|Koi~-Y$L`l!EBlSy5;|4BXs9-rIYhyA^jM1t* zt|u(ls@Y^M6|sO0Gj7nS;DSahMU4jvuUsktSw<>kHYgY{+W|FXEd@O%{Ff$RnB+hL zGMHALET1j=f`4&KQPeB@v#en)149t|&=78f0g{D+n_V+k&=kO|y+x&E3`2BiO=H4F zCLh5@i*Wsv?XJ9IYpPbe`2~=?0U2BxD%r5?v`LOGi0%6~( zdZ%qiw1t=dyFn`MJn-jQOg%3`yPhW@e7%zL(tOw$Zvw)SkgBa}y_}yGrN-j9Bjn54 z`3%UK#Fwv?X0K`ks0kHi)cCL2gq33HKrNRc(SHY#aKpNg0vsW;k;N#$MKG&QKiMsZ z@@%-cN*U?hug41JvcntrSPa7ssVb-U(ODhgluTr!9@qF&MI~0aVRilfwx+47PUeI| zYcBzLwHP!X(|S}i2I)``cJTIoqZ7=Rq2P5l`VR&KV`{?&w&q${&&@(LR; zes_VnJSZ4%e?U19@bZoA(%D9V%7V8v@$61`st3sS}Q;x@tRh(MP^K*PisL={c@ip5n*;sx3#>`x8`ET#) zZPi)pnyz2}O*+uGZCm&Ejx%mIR|JjzIQZ()^Y#1AWq-aFw;|$pP)E|&#+?V9?o2Sb zUpJ+%U2k{i<#l_r`Yjhe51fDbd5ALhXV0q({qAc^Ufy}Q_C@E~?v)Yz;}wxlpB%qF zoPfGe(6vqTe7(t^U#&3NoB5 zxbe={Z?M$!{ErMTx7}oO%7d(l4cPc3^YU-Y^P4W$HlL<;_l2?x23yXo8HL^5i$^2- zAlrxSNe0&V=qdK{-yVsEOwZI|IoEyhs7$=fnw46N*vI zX82_g1G=5{Dk22Piu7c~U;fsYiehh;LA8@5u;8wG?g0`MscJQ9vP+-AM+6IbvEu%itE<1H{OA88>vbXp_9KE&Frv zH$xhK_sU8wPhqwr;jGKUxahaCE7;+qW3)-qBPLENW9IlT{O8J*ugCuOsL2pXNJ9pY1VwsT6nZ=!@Ijg&B!w zKMC{qBF^>~T#991Q|6~Ac%e%4=DH71!CZi+_FIo{87Fj1a0KTM%eUNUj_;eV#L z1iJ0rFKD?p6T8a(TJ;-&=$MU;SIs;5f&|>4|w-on?eT3}I%%HcYimn2OX+&!l(^|4o^#4AnTFm;@7dgq! z7~9?Sc1ni4$WU1i=bP&H@!-~jYfi8|;-zZdUo5`2Z_#P{Yn8gL4WS1l)4OzSfA=p+ zZd3Bg&AAZsTGHy+T2m8a_Wiy0ZTE3wy>^|d7Th^r!>esR_z>Iq6&Aopw-*;D=`Kp; zVfNO2PQUs-Xbn-<#~&fSzq9qa`2*LcV9Qq(JKbkDdpAbyTer2FyQ#s`B`h@fRBLBM&c~|~9w}Ei}Y4w>EeT<)H zk9Z!USW(=fLKZ$HTV9ghw-*ZWHuUZKV;2TB^TZszZ-&GfW^TzjxA^e}#cTfR7lr!J z(NW#StiV~bY+lq*)Lwj#d=-8CGWV-l0ifZx^O0F^t_H9*fQ}L`+Gn5P0YVpG>Qnq9 z1QsN+I*4jp3bQ_c#Gn!|ikjX8c}RVf*Qv%ser>4zDn}Pk|2C7oBHLToy8;IP@~oWG z@K1!`uPO|a-r3FKkAvF0JwiPZAdFEWk>hVN&^<^lp8yJIG}J+aje#613FKX9y`UC&zt z_~5@y0|+2r|K4btEn85b{g9=EDz#@=`M>0o03lP^Hzn4FRHI!Q1I3&asI~wDzSbsa zA|$dbZWoB9m8iP4NdRHn*sNqrjb9dmkH4vi@&wKos>yovG)TK?i(f&UB8oBSwxZ|0 zCnBviG0J+5wP9j6$Pl+*Vj_&MZ`Y+p&1> zQq7-F2|fwCqMqA@{E0cfe`vz$mPX0G#i26)>xcU1ZT|@Neg3@=_2bF$d&jDSpv>sA zM`OE6w>|LQ8t3$M=kMLOW0#GLUfbGt%@L{GKB@{Z0iN?e%eFb9ro0SK$` zIlF8Uk*{yjk*ws~^lMrMToUQg^~mu?Q+<*KLoH*B=m%P|JyLO29>+u~uoplQrokoO z1!cG77%><6DD;t9P6>$VF&X9O(UC#!CQE;|Tmthlm351r%w_Ycsy(;IVP@3a`VE~70oLm_{BRxvoB;(?j)_@R(ORGaLHE-F4CV|>yy+rvxMAJp|O zfYlEM7YKpWk#tZC;}_1XlUON`4Y^9+TxWe-nsm*w<$(%q+XNy zgpyS&Tgm+re|S029;8~?K6kr1S@u+P<_+mUcr^L<$-5HEoYp_*-ie+_O-<`=`Z@VfJpJ?DH$Iyq_EV-#-F06( zd)@ois+Ub?XSt1GWg8Ck48GHx-C8ntt5wzkr&yK*A_5l$UAEaNe+q6os*Q3DZ%1rIuEeayDMPSnvCeZZ#u)B~Y#nirww4TbTQDbPN2G&#J$Of+f#umQ<1An(tefZtAZiZVNb%Da!JDyCr1yfQw=5n z;`#TGauGx9HbaR3DJG-j(KOeRU~R%OF+p=_|FjCqtW0hpO}e%HZ^J!JqY{+G|Em=U z9ksn0*sH3rygVAY9GQhy6~W3YK(64$a)R&}i*W+!=Lm$N)Z%KtN|YFYm7r?3J*ci6 zqU{|pVW7P~T|B7HeteqGPmF*YG4V7>JB8#S%1vE*!zhnUlDo7=f;oBGN%V9bFo&pN zeZ*~^O04v3U`a(rie#3k^4sb}-6fbeBp|*-!5#B|no6su;>>f!{3`!F4sAy!^*crI zk1Di^!;X0GTLXIDu3aeoJsa%W1sMd|P(?9qEAoF_Dn3A4-Qb zC|90;JNWT2CG-CM%(dstQ+nn5E9^;0$1}Ek(m3Sezh%46F(()Q7$05s{Y`k82#c%vd%#o}B{gKap*1yTe@cqS)EHsr-7toB$oM-R@0z^+jc-*@#0E0|g+7eZZcGOA730C88`3;_y(G7`ms zWTq_^tl%czkAm&VR!DHaG_UZM)D`)qW1_WHZrD5i>j-8f-pq?mt-#_~f16BL!d@wE z{Uff7o-KRnh={r9L7)a8?!zLl$g@&#HA(3$X-PmBakP{Wg_HovcNri?LFPpkGKrf& z$gn|zBo{>l$XIJaX5c}=Ldw!R}HQ1!}os!)smO`}|R244~bwn0p()Lf^ zZThgM5!xHHp%y~Zfv&x8QiAcepeZ>wZlGk_f+^ICPDz{rioUyGH%JqQNhA$bZL`8f zv$AAaZzNfUcog1wLj})P;ju1Ez6%YmWop< zT9+TYDD2FUdamn57}qG$rn=n=p28>?Dfg;R~AY;}v zm=`O>qSc%O15hg)=^PLZEW-s;PAZ}pVE^$@0(amGV^9X8{Y;#_Ca@uqB4b0Vyrq(R z4_`Mz*Kix7-%Cw(AEFjk+D?tau}ghoW@i=ohu4{8Ke@PNugI>OBqe!WghCQUW}*BM zadO}V$<&zuw`Kh0~)L;*?cg9bCXMr%3QU;BstAT>YWN)_jbMHLV`2(=;1TAlsEv{qi&> zb5`jlMNOs2OC$1cN%}pY6r-^iz61{T&kl7$fp#M2+pLPAW3FRjl#GvfAOVkf!9<-@ z);cd=!UVw-ic^WwM(Q+S74QUrK~*qxj()4Skk8T+hv0`QSWXpArwIqME zF|IYXQ*T6esgY1MnWUdpq}@8&g^}M$g4G&;uxJ?VY{z{~WrUctX9FF$VVZt3*91D3TS39tG_*~o{(pB=!{g53f%}`F^cO6lyXBb>Ig|uGBw!wC?q&1y1>S1 z*uYmAg)w6`r0HxhG}Az*d-A-PEqMx3|JeeIdA~KQ1w0{n+LNbSL3IIQ_ww_*0z4Ty z=o8EJxDyfT2>(E%QC(mx#qp33cCtt$lhI?!fa)?>t>E>{UA_bTU~7s!k`m(+vHw^?)UkwJ;XAg+M6IKa$>zgcv_k`2 z1;|u?fU+;n<Y6Cq5RWPjCxrDcGW z+$FQWj@x12O?W_&T&Y>`L>7}^ZmeI(y9}8X2pjag8URVs@QVlVrveN|>~`G#FoJcU z)s*%VB1^WN0}(^p3udw+qXWlu7Y_gjMN1F&A9tR#*Hxm$*}Smbrn`9Z`Hoh~EERm) zAk8ehLMAG7B50+|QGJeY%h_|?Wu5$ec|8kVHiA>lXFdmC`x&>4{Bot}sU7P>Pt=c! zwEjqantJ$${YlM~o%syBm6JgaSzWlb)j#L{x~N{RxZ1K;R>ydWq0e(jwS<;C zT2CnV)!+^&5*(Z<=NrsMlh6;$)Df$Fc<_0vx%2@dMn|>!@e*AXd0^G*bhieZyUEq6ktWE8xWBbei9H&Prq z>H5s8fo%C_4-_?%SQBV30X1fRvk4jpaH@rzo?-Q44)!kS&8*}qhrwP3!x~51w(|)d za9q8Q6!j_<)Z^|*E{*q3KMAo?$kxK`awlCVM&6!|?LcC-oswgE@<<-7f~0cn4omh8 z>;WxfI5+5K675U4Nmz1Qtb~xvT#BtLeXX5v!Xdi_#xl@O4rb+nPxHxK{Qura66`u; zKZ4%s8agIZ@*%N9Uxk$3uH!}Eq;{19!|rk&qm)ks^Y=->Tg-&zYOuJdkDrHI(4L+a z3LO)2e|xq`_kh)xJUMOO=P$AgOc3!>$%zc^@R;NfF$$Dz%GhfAA}dC*wz#qL5_WfT zg0j24fwRatO{Uyu9pAd6;YzFEG;GJpkNRJpsAW8ULT2Z@zVp$ldnn<|pS~8MZBa#` z$NheMJ>K&tn6&WotJ_Sh+u9O$9Xrhn%~y^-y7;g|DXmkt)VyE`DG@xTxOsgWV!P)= z3fzs3c`kgq@8o9Ox-T+4kD^9ae?am2E9>L73WJbP^elrv?#8;KjOQ-b-_1`6@g8NV0gK0@FziOko~^GPQ;^26zA6wk+8rK*9G)wnH7A=J@Xe z2=DOuVRVU z9*R3(bdreSNaOI%iq857DcGqTlZ_9ui5x{s9&!6$(^Hi zi1^kcC+x-gdw<;5&R=nh{dHW4eSZGs9aFQ<-(K6>+^>iX4p~;ty^-2Y9z85TUgoCY zx^Vl|2SZR@cu991Md4Sc1rkAF3jG5uk9x?~e&EpODcd1&`4xQZepx7VfZea83z4XY zKw|A}lvF_GIs{lhynwZ|N}qmAs(ooo$m4_l3RMoU|5?;XFs4JJt($BHr3duvlf!En zez^S$2Ap9mLn;EN9dAyu&zOmr`Og!Xb6T) zE3qy{3Qi=gVlS(LCGJR5{|z}PX}Arzd49L*2m z*i8VT&jhDUIK_dKoQ?8g`KL|Gc&}8qNVH17aSj!weW^(xu@Yi;3DATKQqlqNSMW@! zc}t+vK=r>aJ)@D3S_AF?Jq*Tz@b8oVUt>XSkhH5hhOa>M&NeHgF&Sv=e(h*S%!Q|yZa$aC z`&u=H6TUjF-64~(apQdE?eWaDJ07pLv-`8~;?Vkpy@s^IZ$^zfHsl0t`F{A=cDpAz zzZB}X`s{N%^XKsM<{cuTZ)doFo~G=&6b?^gh_2_Z7JgAig!*N!0sH>-?i|4jq}8UW zffu#{emfvSxjM?lsb&02=!392Bbc_$_obFQ0vhUNH$%wT)hUNomGfk`_cBx@BLJ9Y zCqktRLOGU{e3IWD0cI>6%ohH%U(VkE0)uz$8Kt-w8|;GnwB`X6_L7&si0U zm(wMD90XHH?a~l_X~Z1J+kxNWm$lyyCgd5OWALFYNIZ!69os>CIU}S0s^(IaSSODD zW>N*St_Gsdc9=msi5C>PeSH8_1(59O^MJ^csp(J51Rm23@uID74nO$k2kWFWX<~)xv-Zm?+0cxp+%76N=w} z$?!%tDxd;O_hl#6>tTP*Cd$Ls{r_mSML@(YU6S`{H=?ZwkQ2`hS`}Sdg;ve-WKzy{ z;C89&`)mfP)>GXA?IRxG$46982X*Oyllunm_iQDqoOz?pzQt>0b%r4*dSEP_Vn?X8 z^AD7OM65Vgc-^cC;dR|sWXAg^%d&#J=j+>| zB;RsBg&Ibucdh3y^eo04vSN!L0Z6a$cRLf-z}K7SJv%Bb1uJgv+8AQ@d*;`tZ3;fe z3ExG2?RL3te`Qu8*+t7sYnOmfiY4>p5><=1R;aYB!?6?@>HHSi{V8_`CzpJ2azbU) zD4Ap})}E=Kt|AkOUg`u@a6xxxVJw|}37n6Lnh3g|9#?8ft}Z}m-LQv^pg3!g$kP*; zI&Uwfq2j0X_qSA0OP=9nxi?UgQWK|qdIKx#Qi1nFLd=(v_wl7>aE zj}Ayc!1i~S%+@3q=A~2pO`MsiD}iiKi?%~qmy@~%jy=<9n&|w*@a#_0xg=wKwIUMC z{NXdPG!bCf{Y2B$;b%qRGlkg8g~acop`daUj857TI5Zt0o2h0~{Uz0F9?R41UZbfq z(^rdTrME-Gig)v}ecx4j83eqXzjj&zl8^aHS}(%OOxu)@MzfuVsW>7|G1fR zp8Kp+G9R8Bme}vM>ix*Ujcg+`2F>v+-Ty3#z%sc>R=uacJ!7zJ%$D-c9@XzmC+uea!i})B5H7 zIpWE4=RnBlrmi)jRht1Ogl}f(jNVX+h{XOUFNSL*f%k8J0B8^@Y(xn)oCALB3>Q_U zrA?e%P9j*7pTThdZMQkQW#D5yN6JrzL8xp+!?Ao!)9bO&yEQBxz^rdV|v zOtA`1r2f^Tas2VvF&ZTU?L~u2p<3f+?RWPDJ3L+qk`InvLT6BrcCztabq&Nrdv!zH zgBnRAE-6{QG6Ul$2^Y&RfCps+;$ar2=4Z9~Nv`7M>0as|0o#RhVloo}j_4(QnMGvk zU{q4I{ga22ysUv1uQ0?a0q}bF#g?1h8!&EdZzsuin=x=LUqBFsuW%)7z-+lmR6U{O z*I?KLb~^@3pru+p5u~%}Sxxz7Sef9=te1|@RIb9Jmkh#&N0cKJA{1Js43x8on^7ZPH!n|)rCdSd-SI2E8c9O9SGs?0!e<*-MBTuxC zgXCa|GWBBK5S6j0WN$ps0)&MF>V z!m*u)^dP<1Z0an0Eiu-8JENCOph5{5s#80Ei5q;%jV1}kCvT*ovAYt5{T>kXq=SV) zH9=Kx`_=>6wOR&GqR7g_Jh~^)*w~#UEH{;|J~^2vCj`SmPwN9kJY#xbZk2G{B=e}O z;`C_)*5BVCJXKKc$=Ncd#4s#s^B1-Hs00s<3NFOC)ge(ceDG~V2K|?Kl40Ll;#79{&?VHpWsm-^jBi0S8n&@r&+t$+VRhVYG zgcS}3W0JBNOsKNtpdm!+;$hzBgKyl41h&d<(7ikAs1;?XU>perY19T1s>ljtyAH^w zFCP;T?pJO}$>ihrsJWU{lL~#_O1TQ*a9#X;WDu$#8FO}bbt!@&&siYeYw*VpY ztN-f?{7`upC!XpP7$%Ij2_VSz$+`(`S0=BF%=-E5ET4cc(k(Ys^t_a+Rs{A8n}CUL zz3oshjACQ7htx7=4||;#Q8abtwVXGG9quEifHZ{kAMeT(O;q;LlBy-f19%;fwQ&#l zSKBt9l9DkmRV6@CKADq5LbiF6juPro2VgZ#6v>mlyc0&*@~Uz>eAx_3Jch3vQy^xY ze()!h<3mUn2_rv;^~D6xdr-1D>BsT^8M~xyiKA?vHS-Fz$EqvgUFg)N*&C$ona@+=R>R945lL*%5`WbUB~{@tch~o z*7@N19t~+X#Q$Y1G~h42Z{f`px1dPIS?Mp?1!1tIR#!rwx3stdoXo-m&E$j=SY`d! z>E7Z@#%x-!?2cJ-5x3ZCPZhEqs#Vl9L2;ubX94I_9NEd;aspGpzMX zIFZL_2RDiErUdY=lGQ62I{df@5Z?C6wz|eTvJOxSSxiedQEUapRUHsd;fb1<9ytJ$ zKv)-$ZGgrtfgGePPjO)Xv^JG6*t(crSp&oB?!ZjDrHLtQhWcLZIwM+8r3v?cX=beq z77~~C?i`eyOR@*0rc(`fQj5NP^#u%IxNcY#F^$blRJX}AKH=%ATlCA^Oh@H1q+$F) zI6sWSz`uHp?X|zb_?A1+;;gQLC3NYG@Y^rj<89L6dN7uwF6l0zk8{&pe{zyl?Ok|+ z_xw$f#$w{V6V=2K#E7?sagKY~)oHz2${GzsmZ!R31Ha8p4;9CLKx(0+dRhB1VK*64 zIgt*Y7SMkWbI+mr^#-n3Q2YUmZy<|e=`G{{1e9=5o*<~UX&IK! z2*9ANbz0ddB#(e&a5BKCv%GJqbv%?rf)ZgC4dodIR>?3v8FtA^2m9nawk<@BIZt5a zx+<<`(QB_()V04S6bSu?$dxLA>evS_ZcvO_;E5_kFp21W4g7ADO#^?NL#UBBmHVK> zN={m{y+REN%HhkGIz`cqTCEu10TcRaMmW!hdOl{zk13L%yKc+ug)>2YG)(e;8Xekj zDDsZ8wwUCQ1Is|v9uOZ~n*4BGLeTu60?cV)ZWBR&JKlBZabh`YV$Uw; zAOj{bo3VHGa>YQlrZoSn?lv_c&;E576w=$2#UMJ18#vN})v&g`Y22k^25PS2HhJ9| z`rI8V`@mj~<+Zof6(uGlAAusk1&#Ez$GZ{SMKd%?FG0jpC2mg4FU=~DBB=mQdi;{f z77Fw%wKf#io=Sh-GR;+wzHX|2dP9VWdJ+b|8mgkKY6pCe9c-o2M4cBH1j}D@OdQDdQ!Y?`>|Mbd2)qY(buJ-bt;@nTiWvwyq$`N zV2?lf(@PU)2|N@cV~N-PbqYHMWPl`6wT7DlbPB+4rCMl51IN=AH@J08YzCEbXmc`mT81o7SS}?` z(x3_u<_zWpn0()o5iaaJR5k65rL>zxiv-llScBYZP{`*%y*23(B0udOWBUzz;KS_O zSFm-xe`Jqk5NcAp<(@0r>TnTEbRMeJDxz?Q$_bl>T$+dqx?ui)`9Qo=FZVn=Z6tiJ zMFl4r^pXIU7_JuTw40kTd~oi4)}9kq3fXr6=j&s+WyRRz zQ6zR;LQyGnW+wD)Xrn{MG6LiC>7mCo(T|0PrZ%lhYSaM3HJe zahmn(Ribtqj+w#Cc%zQomM*rZvq37u)gmJwB|+vvMck%xt^v)>k8&PGv9ttU1d4o; zdxq^rGC4w193}Y&sJX01M1CGSoDholA_Ed1?y36%>XTe;!PmG!l{O*h^IXXo=+0DT za=HfxD?nfb1x6vGRVIoit}3Gs;#iH)UvZB$UAqj)jkrz?AG5~;)ua)9TajOObNkk7 zr%m9|;gzWsVa8WohRPzOPRA>3v8O)nYLEo4zaxg=x~W_9xCW9>9};(fI$z3F@cJs9 zoG2PFRr*e9%D^8)KC*7usRLTV0p<3jZ&J;9a7b*f3(kB-tcgGtXYkQ`BJl=+1UR3k z7QDw=Bk!X_q41K?03WI8p^hh%Q+c3+r>}=IhxKNuSaLg@PE;9|Wq=ED7uhwpl&^z3 zPUXBtIc0N~So9FQ;dVOdqoK(&Nlh7;j?VMNv{0>b+h4DKUEg=7|LfVRUm9O$zK7sf zx8C(_$w=u^yY_R$$8-MH+Z_7!=7v)^pV)SwWbr4f`BEw@RD7kB3`5v@LMnovnX{0Z` zQ2wCh^DaB(Pn3r(D5&lmwe53l@oBTE@#FKw_W%jVtEL=(h~&8=2RcNf<R; zl+*1GPi9STn^k0-VJG*bpX@@um=No{>!ZIq!guqi=!*%1)^C&l{1@Lq|2UWDdn9UQ z#{YR(#fgfWM>_uVyRWP6{k6Dmsk)(7U-*6Vk^OcFPVYKCKYjYM>@7{|*{$O*o2MQ3 z7VLA~?dnosa_j=hX_~`rbJNa3ZprCq^ZVoH|g1d|RnuWV^|IzT!46WqvIP51e(Z?Di zz2K_@`?U7Dxm5j0P9 zUd;|y`;Rt6EnBgAvw8Jm)Y$)YUhmNPuf9zxgD4bTPj0}sS;3n(Z$w2!H^seI-j=W# zx5>X5I{jZ);?T|H-cvI$3F(Lzhj;IO__Qv}#l=PS^C1)5;$Vf>{H)+bSImE0Iz3&e z_6~RA#LaEXFI~D+<>`}?oBR5>{ImZ&i@tx)aGUYUF8KMMi@r4Gh`N7*_x$@`(X{`b zY5u=w3g_}ax5+2))zSxp*DsrY(X@2i{&m*5`7sSkAL$idL9f_!!agRPmQvSL@@&h- z;$`lkBXL%HT^ufCb}PLbFR(@hsV2lG7=|ofL`64Wn@bRH{O`&4a>iaXNfm`3EMa6@ zXz$(YdFG-|Hp@r8%`57QWLnRLXbJeLY|W>%&k{Wr$$5L94>*P+%@@?;tz<681gVwq z{q6D_MXz2~ecM{|ISuE+J#{V6#Y^erL{nB*J}5Bb?qJd?059&YHFPl#A<~E zQ_0jf@yN1@(lXiizpycTqyGC!n0qdE##kr8cjV!lpYW0K4L?3k)xy^%PIJ5Siv4Sc zo|vw7>N{LMGGMw@xnQ41nU`ap*$Ilzu`}pFe*JPqaN&i`gv}_qb4COQ2F|uke!6WL z)SGul4k4|V)ZS6WbnN>o<#aw)*?vbq#d?)t?6c{0>EcP+0pgXljziwUYU_8q?YQv7 z`0KK)D@TV9^x7QjJZ|6@7?HsAxn3qNvG-<3|E4uk#}$9<@vH4_Yr8{VJHwa7t})xYXIHq0R!U|; zEyMiipNXlVrsa-y{dI92_v-e~{C@rH{g%M)Nz1O?^&iYXEwtQACsSYPg{G*>_TFNy z6RcA>ar_4@V z{8Vp2k+JxZ@nO{c?_)1NKe)7_;A~z&W7wZ+))~2gfR%-3_IdCkK5yOq*wknx+f`?8 z-OEc=-^|XP-7Xw?-00xrDXYeXs|Q0~{#fPqq)x`#&MR(}fVZd_v-^Oj)&0I(U9s;S zdih$Lqc@-M)6xnvjo8$X@cH)X=!oykTO#IFx&Qs<6~LSKqtnUj)aotdy?gh%xw-kc zjrmb`Jm<>Dtz1ie8a*3t@6{O-xUEFccPX=Ab67_rt7hBV4Oy7l%FBn^GF~Qrh+ET| zI2Jja0jqfGTlbACrU%1j%P%ZD_}<{OO6fyh_Av9&>#9KX zstqv)>z;k5jVrB@_S?F%U&~kMcWM9k`E9Efde7fVGQGO+xGmP2OkE5 zl+|P2nWw(v+e!ZUM6C~c{eoB~UZC;!b zl=I$g{1iCU3RCpT?YG%=_eKA4nM0LZvdnf+O*^bDgX7Y+vR(68xk^AHSJRJMq*6hLeQO7LXa(X$l zKT^f?OpGrDQv(rOC{Fk9r$TNuJKVS!>=zBUR^ypv*Taj4YU2E&#U6b+5c&1laWheP znO@J!>tE+pCd|{@gPu({9_ycg_2l-?XDdVU8(+#ksXC@ld(~FgThM!zBJ1Wj6o!or zA8z{d#`N&JE%D7IyolG&itD~gElOYIjMToK{&-N#C-6m6(+_xxyt$zc{{D~h)}<@3 zma%Nq(cG$C@G=956PyEqeTaSj%N&b|2$*x;}dnEG1=nB6y5*zs`Pc(n zHdO_~qR~6mDB1xhc68!G!gW^Mn-lM!7*oe$8p5g!HhdfxLLjQot5$e2|?;%j6bUU6|_ z@E7I1S@4XlGP=Qw_@2BF8N2H2`F%e}M{cdXzvtq`e4Ah2p531RJl*ymk3jUS3sWZlXK(lFGQJ%e9vWI!zT$S_lc8Ep-Pg>F zv}-$?-s!)O8e1TEo|8Jt8f^=%sXOAm@8(vOEvn_WZ{Mz7Acb4HI9a;vq8y9xT($9@ z=o9M4jn=W9U*EnBABkISp7WR&H>C7K>e9Vh^PrDE4mn_d|DL?&e@$omf#HS){}R#d zdv}FgJ9ScbZylxUS#j^xj;pOJa^_bXhPP!%2iZyhP-dSW^KR}Lp+}KshR*FSuoNEsLa@OiVE;asE5AoIh?!7mTZunU8ZW+A% z&I$X)3qn2*E?3^-@W|HE|53(5*mY8}flF@l=Z`l;Y<3&nB)dLIcpUWe+OJM`x6f~l zJ{z97VAsGc%Q9bRVFf&H`nq~k=){y(a|I;^d4S^HPTp%gD#C{UnyaY=y!#S4_+P~6=u z6fecyp%nMx?pE9h9^8UMkPzV8J?EZt@Ao|U19oI5YmL0~&a9bDhYUP%(X|t5$wKV& zRnWK9sc-)WqESvKXWbO@T)319aPv;-W7Uq#&dn_iF52Zp&AxU3l$bZ&aAdmDAQlJ#fT>m3ufNb_nf+mn!z$es6~zmp!;sc{@Soj%C8jcl7Mg4HyZ1V`w9z>8CHs&d3sw_8%vR&Vz? zj!A+&{Q6ZDj7QUl(8PkC3LiDJIV?i-Ivl2wa47kXcTce`Guz*-*&8l&OgQ~@mtqEc ziMkkelJw>)?T2xDCoM)Fy;@u)=m%Aytj+!RAD*AZha^HuRIU;&~YG=oPeJOq<(%*g66p-(;n~4gd%5 z+nns-dhAv^7xESdID~SF~C-I0~HPS@fDnxW zI0PsboN6roaa752d$CQu}K*tby`GNbN z{cjmuXV*4%rm}KmQp_O$@}Jm9p<`fuLrHMIlt+#hkuuV-lGnc*c!+l00a%Tj)ro5I zSN>UXzJMy_O06v`1yd>wAiY;N-9Th3dm9GS2r9WBuO6V=qb0zUtOKF=Vd?E^z{gi! zkv{MQp_lPfKPR!#*=hIxeCe*IJGA3pf$Ul7@Rf@&+ZE8Y#5$x+WpWu#!yE|yANvbKF#65}etqk9*Zzzpz!_NBs z^}6TTUW!LZWZoi8p>$W%U{QT0qZ4bf0oyy+#_1o1cXd+q|?plRT|UJpSh@xwRrzuRiAJWz<}YI zMOSLJcWhXY+xj-(WWVQmWB?COt&2+pc9+l<)yOc@YB%~Ls^34D;pB2dR?HR(-@d4S zd47z@lGjo~la*z0JrGDujgctQ*-S53bXs*+u>@~k%>-aZ6&N3b(t8{vO<4Dett=Z! z;|U2rtC8GTp}x@G2iu_GQpt@Bj~;^zO)EN8S(uBNi{UThxTC0)@D}j*Vz18OJheFe zu~jR_qACPli@uOGV8pEVNuWyok#}Lul6BP9_O|HRA3BK;T#@Fi!W|@Imbc^PpP2Ra z_09mab87n`G4j96NmW(s&tJcO`99p6m~e?>j2%k$($cYtLh`uiTA^0qU-O3Ep)H&S=fD8_ z1+H>#A~f!Tu<57m)F9jas?h30G#r!gsFuc7pW}(l00t7mB&g8CWkayBx?i$i9LvHa z9bx!~4jn>do`2jbQzT_jI-QCH1AFDHx%f%kzM|BNrDR5df^BaW8R?i~AyNSiCA_XJ zNn0KobJ$yd`A2JLpvGEf*XfrZ7XVS>vhG4fA;WKTVS#v_;ewg510_F`Lh;n;yg==v za7nuz*5&Iz?M?E@jV&!)*H1!TE6Rts;`br)^BHcVZFA1W{sh7t+edi4E)O2=VGp+z zzISkdgCZ^zNlZ+<><8V)VBCynOR%@29Gj(VrJPNz{o~`~%`!b0*x8k?HRlEsSnQe) z>ozwxF$frzJmF=mg+>t(5yx$}M?6p+?ynvH$eM@;!*Zmf>e@%z053tJ=bmliWGi(E zuV{w=n+niwO2|Jc}Avn-#>KQVM&|7EiT z^JnmKmJqhM!dv$7OLIIQ1wc>p%Ip-7I}_h=(~ zV_W*(;dbs}Ui!9|44MO~t?ezb+Fw9ivS;Z*9&TY*`!n#h5b8`W6Im?J^&ZsCIoY!m zYnaz@tI3eRukRzH!R0oe+sQmRA(#F4_NyKK{*OQOA*88&;vE2JZZKP_>FL&5UT%xJ zKDBE(mC6$JIXgcWD=scJ9ZkPMosR(|X9f#R3AoI#9N2~ClrJeM1xi_ZdQ{#du`bhv z$`x(MePB7sWX1S(+q`e??{51e$gkGJ*x9sdK4lT(g;{Rhk3?CkR_ z7q_FO`9>!*WH%{wqbDs3ixt39uG+OCW_v;jJT_(G7*1(ez@;xb54Mu@A$xgATD&nj z(L~(oQ+n|!oAV5ejOTwI?vEct%|_FCtY%NRbiEF1u}Ii9WyE$_5$EP1c+^ya&Tp$& z)XS&&XgXexpA5t?9?w^sA@*mGMP7OevdHU=D1dl)wfSGNwfQS?%Y!p=an<{EMofbC z7ZtJ3s?g-jly2ze#1mH*J2BvB`VY=5FqF4kx7}kho{ZBsrKT>CJyx4=U9-6#@hmKn ztDKLI_h6`WDN`#kS-*Ar)9EQ{f2nF=PslM2t0WGy7>gwUmRV6=u2~P+$gGQi*U&Z5 znI!PYA7q0*;FOiy_!9kek@ic;A~cJCxyEvh^SHJtyRxx-q`l%&`D^q9-8wjHTS9I^+8xHp_((*lnSqP?T zBRWyJZaZ(uRgoKQG7TW0t=#oB6Pcd?5k#l zzJ1yG3@d4So8(k%6b%JTT~@DH)=(yzHmX@|FTc)O{&hH`u73w@znA>b3wyY~s<(r& zp$b5EOaUdL#~dPDdFS(qelMz4o|wIB-%hmxSLltbmN{f}o(-~8yklZAU_foL`xYrj zPw2Mm>wfv-e6rfPxoHgEM$yap`*NQh*2C@rtBG-qeVK9W&B(|I(CD1$%+CUl6%Ygq zgTcq6=3~*paW{fw;brQl9fc7$=T`c+sdt|qPB;1wuUbunCjbWth%-3>Ph9nSqtlM- z(Nbe^@ei{UK07L&Y3cBsXIR9apJzoEUHYL>{eERSlIn7MSiiHiWi$8Nk4g79j{7i2 zW~)bC-^XPa#}(7mv~4Rqf}nTY200KGbO+dL{c2Mjg;jc06-Uk{5P->?qijJJ;}Xun zU6xi>2&CtKOrkFO21^7I89Z)2LQ*cDv+Q-@x!stQ>2sg(C?I%#ZkJ!bV44Tb$OL<1 zh!kCF+g3(%t8#-04VRK!*m^q6uHEZDu+j3 z+Y@P;H`eow9*gA%OX88Z)N+b*Ek^V?*xyv5%zHLMGm*j;Z8)BU1S>AltTy1SoBD6`3Yk6F5 z?t9+}N2+lj*JEHnV?U!6Iw;3!t1Ai~p*9l^FQDH7C9*%qzPX;tL?t-_5sSK>uhrW6 z7V;=zB6+2fH_{*|C`cc`w}6*UN>2Xc?X{EPCVD>1Er^^SgVebmYW2!T!R{~XQ<_3> z$S(n*H+SvTgWPOUiFg_t8_zY2{vJ%fxxYQ;{wIuXW3a|zij*(~)a-ib2{>(z$$;h! zB$2v~n8*Wa2lN+=H4@GhWI<$!MeBjjY|jAswsio4M)$s)U9Tm1;tG)UaO8386;O`V9eAkm8GsFb@{;$3U0VzqES5PJf5a^*9c4rF)gEys4 z&dKWd=LC@`Ov6qgdcwKaN(-ca;XsNTKmVX0y zyAy4@)>_D&XU6|0>?&<+wd|@RDHE|OlXeYzbs$kBKew)rQFu&QQ+^%is8V?F`xM_P zt}4*MAv7x|I~~1 zh1B3}pZSD{5k^b$)Bu_0HjIiW@2Twkd{abfEwJWW;7^R3gc%8OW78sr&O;3V3A>o1 z{t(D2G+PQ=%DMVhy5yh7GRvk{*QE6DIwXodf(*pk{@eI4c*KZNF-zEHw6i-jE`KDG z%V%^BV~Rm3Ekj?U$@4Css04~Q;^XIJikR>``OV1!E<0Q*^MY(HzCqxONCZcTMTl0> z8(Da46P%$Pz3r`tnkjyxhRe^fL!nagX%kRO;Fu3cxjoSoB;hDXiq zyT+AiyB3=OF&%xa$z0qu&s$h5!lpaUGfdqMY%rwDL z=o}D!DB8S&lI7xHN5KEWS5*-)Ev<#WfS~!P37(gv_X|%jA%a5S3^1*ZFvp6rGS+wR z-h9`&TFwUdrV8xltAYly5~+k-!<{b%DWPTcM-8^V zMMuZJ4?-KBva*9Xd`lh7_WRRCEgFM=#v{2Z@bix5tEHd*Cskg5ZaXrfz*AehRp2W& zbnS8Bel|7MI@f&sO$h`?Ak&WXO*Yd-)uqj6csToA+6K4e8pcTm%=aU%pM@p)uE4SG zgiST7nXm5#&xOm!l6kInD|<>y(tQuJM}XE;=Xl=jtBHb-uFuqoG6627g5jlU-~CVRC?B+_@K-_}(3Jq;ZIUM;+?!K$ z`(&bqs2?+M8CkY%9KEPV0n)R4&nORO%vNK1j2WEz?s?$6BWdl%JDE?oP1%QsN2z(a z8fu*-PwrRlCHf0(5KV#4!qf=~lVTi>{ph}L5)o1>$nVXYt(FRenT~3HAN|8gP;ZOZ z_K(6`OTeQQAj!oZsGsi8`m0KCyJCwY`f7LHZLmhu1&33#MQ(^?fxlcG4CdPQIU8UM zZ@}Ipl|U%@BB$8fuKiV|Isv(hdK6_5Z4fI%742{bke&kG*Bqz&GbO$!0n~2*aA9n` z%ihhsbbk^8+N@SpQF)p3bEQSn8^9dcHFzQyFRJO$QO(C~+92$)lZyIUva@yoF+0`x z+`4Yd-^t$x0ddv9pTQTRZbv#F4gheJA?#6Qs0jpuq!S3b3+#c1!}dGAD^^c3 zf-?Z?-gi8~J6LW`x<6@=p9Vw@GwamCA42zSoy-b|^sxC|4>ay#T5isF9sqm)OtZ#( zg3@j2(Vr5Dt(s@i4yKikGg;sMvkoniscnc4uHmB_ANP8u*@YXt>DdcPf$ zX0I#T{8NMOV83?M*$_Ygl$&3qs9+GY>!HrG9@3K%bXo+lH$8nS0DK-8_*Cy_nqAv` zTm2c}C|qWW)jr(;DD4Ko?+vj@Nq++vKeL^gkFpPgl-CM;%RS)w|03(r=2Idp{f_tq zG?2f|=r>--WDQUO@G?nl+IzBf=PbcWSNxm$>=&?FEx&CZ-#Am6wXYuRgC=ZVW8e9qyibRET)t)tKm* zSu4uQPzxHS_aWkIO8o+)C080sY^_BrUHUU8Hu7^#OnsMH`7Gglwl^(T-y8`1ujW!h z@F)alZ^Js#q9{Plo7X=La#9inMurDX-M7uV;#07a%9)v1;g=Q_Eq@yHRH45;7LTY} zpHqk?rYC4~*iBT4+~QqP3&(ogYN%+9wFN{{$eI2b8)en0^z2UekozNQv2QJf6qAs) zTW<53ZW!205h#J$q>5VIFW{sVjHJ5>)B8-%$$aH+nN&q$*%yZrng01eyHH0{z7|FyDtefbIDkhatmG!~3DS zZj>Ir7dg~S&$6@!tbBiFYC@&l$a45MILVFyOzscBYSd|z?{t>0Q-nt*#$V|35%q(m z-2MJ$=Y~SI;_`4&nk{p8LYmsd`FN&;geHK~i1&}k)l#+NmTWnN))%>@uY zexW7}o}msl`xEn}6Aw3>oKNu-2xQ^+n*!?qvRDgkh+K7RJI`R#Z8|A-=rO;WR#jSd z=%>UJKIyRYz16;RaNoZC>pR?*T}Woiwd;>S_Zy%FZDnOKHocGc>e1@Pi*+{mhXjEB z{ct=T6h)nMgKh?tc5i@{ya$4r(1(#lK*H~?U{QY~k`(~Af|DBpCp}xlHwO$6BwP`a1{jy{Zlgboe^`kb0?BT1p0qu1?L=t7NRC(rH)- z);(nA*A@^&T5394ZUbNgFqZtDsQ3kBK0s5u3Hi1hcPJwpthbtSro~}6+*320-m`gOK-aI7&K2fIA?lx-^G51a^hxj~B}ceNTW+c4#x`ZQ zv;rxYA%%oc+|A^c)j5`&+mUGWZ;#ux9GQ|?hRsc)5$)gdpes=mWO_DTAO7d_j_e$K zY9WVLl3WpS{#AT$tjR@eF#~OcE;osu!c@O;8%_tZF1nq6I|}f+g6O5=9sI=~MS=J= zZ}#Jo(jQ+?tE0bTDtX7oEXvNEyh6p!!XhUxZ#+l*r{NyJm0)%CCz+=(^_}YTN~3=F zABjGj6;qt{b=I`Oj-H;LHH29~Wabi}5s1_j`E8jmao-D&=SAU)0N+NoimIwanGu88 z7gy@n*8}+n)^cK}ucpUFFLtgjqGlQs({3Nkj@!Ezo6ba)PBO-)$W6`M@*k4Ty5*0j zgtEN^TM@yZ|Bnn}k3Ww7^C)(K z-Q6HHkzUhro(=!rCzDQeC*A9;_1h8J)q2-&4{D)+0b}uYd2a`Y)AFb`80N5dwQvLE z4jD-)lpIwU&`EPSq<>Cu^;GNy@W6Ylm}0-~N5EWgOP=(zE^`oaTQj?*Te(2N&({o< zpMcepYhq+_JgC?zxW{1l4>WC#;84Mh|g&r zed)11K}sCb#E}V1y_>>{HMbx5x_uHfVxvp?j}pgsiV&>UvK)NEMGEdgAss!GiB>nb zc`B^^6W6o1pRWy`;8s&>Lm!n+T37P7-N+AlJ;TO04hS~Mnc7>bfwu?yULD^r*Jnj0 z#>Za(l%wI-wfComFVUZ3Vq&&kuZNNI*?vuG1^!6Ww`D~4r$P6>w)keZ(L!ieU>bH9 z=>)xfS~6l$t95*?DsAqXqX4HQIwo2zlZu<)IQ8C<)gy!djzXg^yRI8szte?uHEbobp2GpPq-#o(vS$90TB-r)jAng%~ z>HOLPPjWg!cPH24B29|uLu(zt+9Rzlo!U0KhXM@wV;1uEX2s`+^ud$)4cz+Tr}wGj8E1N9UJW(tvOP4$@Mj1`~i2!Kw`6M zdE5&x2&B{U?x@0bJsi5{{Em%Hy!Uv4A#TIoBMEzG7b(V87I0VqCj>UqwIl3-aopuw zeZsg|h*XYL$qacoIL!&3;M&4BPr(*2@oOTuP3+KFFraf4&(R_S*r~q{$P0VdA5LFF zy8X^)Zk}Zf7*-1`@kb$$0qFb%y*Fj^`x+WLljb$1)i+{CL?&!j^M~VJ>CfSxGj1L; zP2~^4>xGu3swMMgcbx^(-$)!&Z@x)!&UhU32_2MD{-mX`W3CKb0xnT|n_%hkXXI2V z2j@=ht(t6}Yz4Gghph!K82(q0fJYDA6QhH1({x%E36On$7e<-w#`for_MTzYI)7S5 zh><}#Xs8u>qXTm%2M1*~b?bCGII**wd>V7@E6Qvk!s}5hL|SyY>dzM#YX#FT->ym% z5{T*-ZFtj8A-OB=SC6#H`o40^9lBl%FF#TG_dSKHIQk;1!RgKW2;_}NnQUGc2J5Ib ziHl(R*1FDBXKSjT1^0!OEHAlYn*`$k<}-hAju^=wW5rnN%_hModxFm}V_rZEb+G zPy9__dqO$EzZdT5DV^BAu05S}`PYu3`+w*71ZDdCJrH>9|9lMo^M8NcPf(11zlOF8 zeXprM#OdzySH&y7I6#2r*gD~iy8l*Tn(yCfbK$0GVHm@E_olIrpJ6UCy8rKcW6}3K zX&MHfZae#O%lJJGvLXEco!=1x?e4aG*_Sz%YPH)vsjjI(4SkfW?eAXzN zZCJMLfzHk*CPio+qL4mj2DJ+>xA9lu`R#H-WE5U4H(NShzDm zkcta8uP71K9@FYBQ+&+bP?e-l zfH4KW#ltx=z6zd-rie2!*Pu|ewzv^pQr=!v;|SMd1En{(rDb=9N8+G|bnmgEhXku~ zI||K-*ibI7m7?t?tqGmu7nRuobxKpC?A9X>yjSxVHb-y0rB!%^pmR&E6?i(t#KdTU z65r90XjbH@Gz0RY-L1h64^+o$SS5lyJOMFp3QQ`S8-dc_%L-8>|^?2Xx+W;B2O4_q(c#`UPa|3##YeTC}>F@yQ-Sua<&DAbSrrg?#91no*B zf5qvv@ZXEeJA*jNT=7Nizz9i_7OY+09+fpbHUIXJ)}*?5aZ$)ekDB3`4BIwYB8*JJefYG<1mHTD2|K)~*9^*=zBgZejMEkv-XZcT0N zxJV_`rJL_U{X=xGVd#%G*X@Je^d;|bzec?RC|p&AyQ<2Ggjn1ZaCF*>f*i%&(uysJ zQ8e{O1jN4zjOI$GNaQgcRC#A(<&Zm!sJ3shH$Z1O2u&aNgK!06QROUBhSi9gY3PWgz0u`>938t2w&%G!J zdb}qht-Fgp|5H220^i;o9Le_d5sh&V?>=NHDNM=4P!KEseELirS83I;k&n2ntt13~ z>dBLOlfyX1SMQ2M-QNWD7Hfgc)GLfOMzILD&u%v{^Tu|L*G^c9_s7vwyYxP&vX*7= zxI`!>k?R)Mo^PqSkaEB3f6d8|@v*&241c{ajOc@I5Z9L^vX#kLgHLbzdKys>NY?L$ zQq1nJyxHDHPSV3=AM;eEhSnJKObyUx`06;Wz+X+qEu5@EJT}nHI*co6h|~}o#&6J` zhui`UV@oU<3ry|h4U2*#XsszJ$@{_KkFeCV^rjX@r6fb0AA3cxlU_R><16ewz71U5 zkYxQh$ZUlcA_Z2LU+(so>^*ejP7yFrj2wx5T)?an2D$i{2<*V3G|omr~clU5cno|0t(Vl0kcw3 zN?>VpKguo)SYBM2k06mVak<;v#AbdKv5o7>=c#Vv{gi?5$4Rl~IIAH$A8-8zkH7kz z6yCoS?~}y8tQw$rJ-P9GFbE8OhlFUQ`)7%It(}5|V^R}~GW4%ca>gzx`B5uqS?T;9 z&l%wn3at7EOVw@<*=AY3GQ2`=sGgLEL)d+P^$t7hyIoOOqnV>+Q-$v;U;FLGO_=gn z`?ajM_)8r_*nM|J+dZ!%lUEw+SbIQia;yKUc-V(Vse@<4IrMxtmNWE^ zmVH_l~i^L_hq8Us`8{ z%9PVr9gg!^-piip_djsLdOoLODRW+HYbmRaSq9hi(C1V6?36qjK z$CTr9p=5dP7uw`W@CvNj&siP1?f>bdx!jV6NH;pp5@%QiK^wbecTL~-7 zgjd99^?{k4IX~oBx{1W8tL&9BaP~ai*g=dHq&Yyf)VJq3Lizt#v(gFqT6=TRi=dfe z=}QXH8DiwJwEvzqtd-J_8X05-4hhfl0HBs#vbTd=nd`N{lZg04_4;Zrj_D=;mwoDw z^6i3~uj|P$&t=F%s(%ev#{}a5#PSJJ2 zSYWL2A(>mAs5-!-i+n9*_~dI;5t+c}JD|?IYpyalnPwx9DvHGG+)_SWr+oADmR%Ya z_{6AoEpE;sl!@#_gW@^S3_{~=KF?bdQ$>S^ju($(`;~M*jDEAfUWjm~pq&!}irq;y z94%-46+@B+Mj8l>4Id>iD;PLDll?_2_1FU_J>yFq?*29I=f|um5ENS(nn(Wx_X&1> zQ68mS;A8oAiEhJpOxr;@^dc;HA@c*=NpgcFuUii(mo-qQp%yhDPJxl5?XNLgm_&kQ zr4}7>6@@h~3D!=K_C4!=;zyY6zx?cs9HlBHPo(92O(cy)OrXoYhXXX-cy|{43ERW9 zQ3p78M~bcWNp`@veC`QFii6Bv@~dFyQ(0^j}PiXGV>>hj-~x) zgZBr1XF6VE1V6*?+!-F6;dl1eq0;@FrY(c^4Gek4*_|WZ34g-`Dop^4(TdOIH)W>B zUY?cM0rs|sk8P}cBOGOcifH^_&5bz_AeU4lFETrdtE6$kcXt^tNL0unw>m#*gKYo1p%jX zOws$zb8^0o`-`1|&sV6RLj8NBL&?Z<7vGJtE5nVKpqq=Z-4f2XH=|zECZ=1ojsp9Z zDvqy4&y?}$C@5atZ)9a+KJ{may8-mr+}gU6e@wq6Ja&L-@3`$sxiHPkX&XgUtEH*} zem3%rO|Lx#T|LC81NJ;bnnr*_uzC3rhP1&a3r|x~+9_@>QY=}$R;v05`Q1U`_kfO= zo4Y?9cs;Q@TLOPkx35J^3zX5DwiQP0|L#{%7jP0yoj^?fc$MtLo|L8k1*{D#g|eSN zePaJ6nJO2nt6KBfEsGGNGx@_vgYorCTG~?$1DW1!B02NT=^AYO=^%nZ)2&^~Q-c`N zG!7x+s2Lx%Cf$4AcnOLfZ&eZjnZ zytO>N2W}`togHN@ zMZcR@Ea(jV05KrL<=Fno^-3Wr$Ikh;m;L4rQT%s$6$WZM3w5LQ6n8DD@_x92%ur@3 zuFu?iF2UfL&qcLB6J_O}Nh}|5X-`~Hl0!HVtfl#NKy53EAePT{#$thiC(Bis4VXI$?MBp>oO-IWGsw8Une^*ypV40K$87D`Y8jj0Cj- zddM$qsA&xtA-P~Dj{uwzSk^N5)BCeq(EYPWL4JNzi9U#pk{W7Wn{~YOL{~{+$Q=Oq zYRp9G4^x!-NOf@AwIjQ;kBbW;0Sa3whR+M!9JfB478)P;K7j63t#!l=lm~o~x4y28 z%O{5J!z0kI!^P8V=j8LZNnJCd4if)Z$sK|W?BR>Vzf-eeB zY0z}%Wt7-tNe>G0da+(LC3+Pm;L zZ1{8Qa0>7+l45tgNz)cO!0k`4s@GwwUtVh=ODomZ@u%x_{rr;axev~j!!0kksPxx! zA+$)wxB=yVc-yjN)*gQrdvC~Ll&xwUd!hAjg>=~( z2vP?JSo*%E&X zS^<3%ufThj@)Uu;eZTT^(i7128(NY$YskOj8Eh8GwBjRJO_wM6egBouq87{Ex)nmU(f>7Ax`(uEfP&cibeA;!MHA$r$Ky@yIaW~b zR$7xNrvOfll+}SP?(-;$6zj;DIp(wkBb5{1i|@?*vMFa&QEndd=xC#(EUryUX6zr? z+4i6K(IirCM?v7^+ML%G^AwlR!jC^Fvc{qi{S=kHw`jrkf$8neI3kAnK&+cb#AC9> zGZz&%#fAOSG%YbDY>kzb3^*sj=i&o&^`IB&ha(I!HVCHF!H)~ZB-c(lI=HH^XgVwp zTXf2+<`02q_#-FGo*@0iPbapQAefdvn`bvhh`bE;j2xWD&%;eP0)95&T>)QD^6>e$zjY1XZc%Z3JGe1BK01Q*z zxBqAxzowlH+{ltT_Hcyu{Q7xKF=Pqzxq ztzY8e=H;1fZIN`%Mp6iAe%1(A*dj_8Yd;y(&-7$ttp7(QL-A@aG9!6t@fhO1x;pWh z?`m61Ubu-sE;mBK2J(O@kKGjc2{2)V=x5m6(v=5GUBKWN9bIz0c`>`&%B;L|ry@ z4@p)`yfCQ=YY!6}7lkJ}RyhL^SijZn`hvETRW)=ftEwhvSAzEEp2C6?wn!3;_89n% z&Xp9#{OG%Q4cy4XG)KKhZU=#(&2_vj??nZkEYD0=r7JS_BsYFw-6goh!8T<70;|FvT4_67(` zv3GGRrXav+CQDNf6J1HQyZlc^NBp98Jq+2yW!HrH&EpW6F-64@Jw4u{=~vrvbQD=H z_nzv}kUqDpe5G9pV_~*Bg|0cTaU`e5A{?I`W@Jl~8%kf;cn|kni2vmtquxbDm$S1i zI`mO1T7PwMk8W(cw13EM626zrq1^f4w_5BvP&}(C4<<>)w1aS@+rnZeDlemT33_1B zfLly+Z_U14JH}M(SH`9ZIiL!A_Hz8O6F=v=<#;_dT^S4sZSCl^~cFI`hEDr7LUbn|6SY+eVK?1y_}h3 z*nZEC6F69bKVTBZ(r&;}=5JTiFdasG^n2;(!sH7^mDTM|OViUqe$p(adI=K2I7unSDW+KrhJODUSRK;`@bOUS3vSro?oi6Jyx<0`i%a zmZ3zOD~Fr{8a+l3h5IjS{`cGB%LoUSS3FafKbKetMFz=$`Q?MUQKsH<43E!t7&X|2 zpzZQr?7zuOSGqC+Uz70S>W&-@mk>yqxtM|xx2Vpe&iQLYMZM*YGXKn&B9HH4h8TQ# z=}CG_{8^KN@5}cnQ=5|)Tp22h5Y#f3bU~hV zrfoJxQ1H4exbu+MMT7hQ}Gl`?wMPAFwWld z0s8vX zbF!s!_Yd|Vdk5=V7j>tN%WgMauf(d ze0+2Ivx!RMl#J&N-nOPz|G8jSQ|0`^vdy$yU1VsY$h|K}G$XdTaGka2=4{}|bw+;t z=_@bssFLMkxB$=(YpMR-(6sOTWj53HPSo{ zuRW9BPc@Njgf11S2eV1T(9*XV6YK?_P63jaSL6D&erjW^a9^(Cg$Csc`OUJuUDz_W zXgxoZK9@#1XQM8M*_Q*#)BqRmCcPEj#~8;+h2w<0YIPC3mt5-5An(d9IMzoqmzuNu zVO}>_p=`Ceq{`cwpT-8=UwxpYv@X^%7U%Z%E;vn@YBL3zRXU1xaI$oXgceT&R|Q{t z9%q-5dtrj3ExeBOJ)Sjp1PX)Zk>knw8zS|e6b z*>8snjhM6ZJ8StNNcohFe4TI|J~cqy85TL z+a|h?%&yj7O6RSa6T1uEeKYl|n7kBJu+AzQvN>`V-$?QR8?|>2pKA#E%(6u_b{p+? zz;5QV?IrMnZRc%kARACm@ME#s(U%SN7NupdS+Yad9TDHT#7;PtIdNIqSctYx-D10k z2Zgq7rX4ANAVrGr9Uc>4D=`1Bt;mL_7Daw53j*;>3vg;LceC1B9!AT%e(En9vM$IT zC@j()$8_n-^T<&)OU_bv)rcp!8;3A=+fMgQZ&dRTL<5ac+s90W4E)5gZk9 zu`@7jIrGaFoTK(`*Vr;4&`o#6O$X%K$w5Y+gxQ6&oR*LP3@y>t#uELeTv}1lEKHR& zbe;j)$3@)}wZo`&?n*wI*x2|WDy;lyAj1E5uh4a~@Mq=|m|6*1js#{ZtAQG;`G=4Ehih?1LA~6`|L51E zu-!lFUU}T*w0Ljy><#UR-koPFz!fZYHDmI-B2$QBVTe*mU+fox z#=!~qh}}0_TjIu*`n9 zj0|P~*8e#rf0L{on&$Ak>gA`gVS)<`7OQ>j#d(hN_zQ}GId^ec2E~gQRj@L*FxQVi z!v{Kg279YN(I2z#l3O1iWX6o#c;By2GUp5cjZlEBMh@6&oGA*{zlP!2_&85CPG4gd z#GwJ3QyH_waFclvMT(yT=S|BAnS!nikdeN^5AE-XJqWX-2UB0y0;9Tc*E$CL&(Um zc{H=9{S1vHi6rrB!AG6@`^-RN!7HO&p7YmcS)sw;*Qy8)k{bBG&uO)ncOMUuxVnn_@+kZ5G4Zt`wq}cM|Cyiw$K9p+y z5gi}h%MzAu1GgPBOxc!tT01>Fti_pWqfdZn3LpaMViQ#PS=50{FhHG0NI99h`bi0m z#gpLv0AjgK%$acOa-jc_jNJ#9JlSO+8>OQqz^I-Wua-?}to>f_x%%8rmtxH6X z(S}D5y=6pQet8T#>F(Dndv_mmMjkp6+~^E#<9Z=t=cXl8Y)XnIp~Uw1Z_KWFCm?{CJLGjnEV+1=OudfnIkyq?d;m16K-eQbOj zIFxA#Dljoa7GC^o!BC(S8TVEJYtxN)p?xq|TpaY{cvu5X$H%zAd9*++aeBwv%7%)Z z)SwIWSYG6IKwj*uV5q4ffo6v+MSe|;30pi9AtULlc+k1azGkQ}m4o?oP``8L0jsu< zVms+_krGEQTPv^Now>z^xy_DUt>9G?O$6Oh&Y3}ERmy1Sm%OmO@=7OYS;7=4saD1k zp3ENTY?sVBdA@;bcUz2ZVJ{rjE9P;SsA5C2*^{3A`}AK{97LpIl}%1H?&eyW1L-W_ zQ=kKt587EZkMAj2X`vI)5Gyj%B{&$cv*96>HhN}6bV+~RL_w0vX4zXGUh2PlQ#58C z_U!ze@u8xXrOr56Xhp$Tp`IGrb@aF1l?uKY=1SW`338H4Mn)4=1hoB%xi}&`JOvQ^ zLLd#maL4!T#wWFkH@Oe^%fO=M;N*P!BF1i4zG;dyhJ{1202z;jlvGm#T{y$<&!0Z6 zJ}4UoP7f8}^uP^%I@B3&XNa8Y-D>Vc+Jp0q+AFYxy*~_>uHn9RWnJARFt1u!S&@^I z*SR4!cV}xC7AEe|a>dJ>*1mn@UE)*lZ@<-At%Th7wimT=+m0xTKsNDs75?@Id!zS zr)S)hCr0D-ojjJD$AOn@dLm8F^^^;=Qj?wMHnz5mzSwD&O=4y1XlO{v$kch9{RYcJDk~Ow#MH;?Dgw3qO6MT?d>wNe#1K; zaS{jV0!EY8_V#pHa#S);V9&gL6i$=<>(hx<8!NP`enE~7BW>8&l$oe2z{cus3s?=e zTTDd1=eyJ%VOt-Led#4EM$yI?Df#HpBao2x>xtEMyWbQ_{xu>v_`t26WmBgXYQTEn zY;GRZyzuk;L2UcdZ6MIjG+yQy1j*T~g^nkTG{zbm8-Wx5E)Kk|4$CY+xOtOiXRR;U z=+oWje56V7@ee~i#Ec2?G$*M;>&Rr}Ip ziIIeZ13TAMqW7UK%bn0QZulAYrkaY1J_|B3G6e<2Z9JF@adJY%V|Rx({`Z3J-wVHk z_2aN#cF;g+Nn81B zS2=wJ!nh)Fk;4-c=-#?oT7FLLZEcUym|jK{X;=GRDqKxh;^E9YjI=y@Vkp9_Xw zfrYS+Sqq_|Nh>VG_6Gr>uC+ifdgOoz@-Xqk?XrFw4u=cCpos1?*7G<(38i?0b=u^Q zNseP?V6Xtfzf<+@&g$ypo7_}){~Ft@l>hV-$7<##y13%uUN9{?C+o>e1krfBere5* zV-`mB_b3Z{PV*n+vTvi$iHV8vPm>6FySux=FPWf5b}opXJ$!aNZ3}#a>ot;3MdWmJ zbYx_(#E3{k(d|LPGeY*@;2;*Fhf`sHag5j+&j(?DQ&Z^nMC0)1@jsR$2d}zq`%X2O+t~L+n`t&D` zaFDt}i{n27o%dew{mFFFBSBh;kcj9>@ZD4pE~%^}a&WAjHD3d1atMgjV*EAiO_Tn+ z(xo$^kVT&?v;@rX%{0(P>DWR)HnoKv*zAqR&fl$+2RmH=-aHcQx{rTvrp75B^iO+G z)$%z71u4FVB;~6YrSQB*YW>#e=jRusqNXO&Z2%w8Z|kRN+usM@90UNLLm)*ze%#)c zxiDB8pU^=I-V4I~va&6gq3S#xT&?sxhfb;!XUjPBI2uCBoRKn6W}5tApuq{TZC`m zC>a*2*s^^!SO-LG@uAgoeG7KQDM3dFM4HE&H}{jMEW(mLefk8b2QM!MNv9gSzGG=q zB!Y*?*K0s^9k34*_ajGj46Dfj*5DS7kSmm;@K2wb^h{k0ONa>wFi^z34p(JW0%P(= zEdrYd2L_4iCFGiJ|w(K`OU;Q0Su@OfSM zECk=l@%?Vqi@IZig(KAb{CuYZu3$&Dqy|XnYulAHn1H;j>? zr|Uj5ORU|t!TR1_e}8{$r!k1Pf*eu{%;Yzfg~gvIXv-6vKTi^^aoc$)Pcqn7m+%%+ z`QSwRS_=b`?nG-B!Mn}Cxg8J~Xs`_)#62f-R4Cvli0$s}=y(oR=q}FRZTvCrpHEy1 z^P_FHSJhEYRaidwm^uJO<4UYge6qg2>BN)tpIYaidpYQi4%&m?SwCRsZ9fh=NfHGw zrL6#MwOjnKBL_dR%2TA@6JGkSAvN-qS{lerA*A828VvCQxf|kQ%=! zWv(FZYfaZOT9PqZXn?{23N6xLgK3QnkC**@YNp<&(b3be@xLZ@MK^faNRj*(Fr z<9L6H4E$AfvwJ661!|K?-z(D5j+qmqi-t`+{#2QZW_SMi%n!e9*+gX5#?DW40ioW% ztRYyburSYd7Y_#w>4P2NzvcFG@ZBELSUKz9-t#5DzN60a>m+d31tb;nTN^NC`yw!` zxcRgT@vfu8KJX{Ovbdl(--2Mpe;0A&tu_hj6P4FvrE7TS5>gwPue*kd6X+L@#MU@wFoPL-xA4qED9b;(s3DaK{a$f!FfvC)yqNPky6OW7 zoyzI3Pm~d8-jVPM!k=ni%>qhT_iM@T%o{!YTfb8MuaIb_%il~OM4+~0Vt(*;YT4J@ z);uqQ20C8pZQsATf;cl>&Gu!&;TGD^0Bx1D5fv5gnT5>6b;p{X9+?8vC~_*Q{=U9| z3bxL|{j*CzW7^}`vRD?I`%iRQyW0^78@HIY_~`s^j%#^ zng`4|7VMpoO;~<_%1>VCY#Ah@Ky@q&G&E#1?nc0A-_0|=N-Ey!!9 zdtQL{6qbG|c(zK+0$vcR(N9UNfB`nPpw>k|6Jn#I%g)SfwWxqPITi&0wQwI^A9*eq0tJ9%9*PK2BmaFMqcH z+P{9}+q!G;g}KOEDlIlQCVu(qeU+zuAuI9a)IAxsSP@GsI`qXzW38?8B<;yj#+UcF zu4TTUz;LADPhL(v#8Kg$xmJ)Uh>_c=vq?WrejeQgio86Ph3>tpt1BXit|JdQ7$)Hb z*UKNZv9YkS3Jnf6D5nZ|5h)obJ%;t1mzTF1(RFxq#9>Uls;#Vy*H`0NTU2CwbA9#s z`0UKJLKDOyP|?t8YimL6%Yr3djr`#bIi-D{%49};{S`ocn;(MeLS!iisRCs8V->fe z)pbcoNbbkhdXm}ef(cA-Z;2ztHubu=$ntOAyw%eSEQyGSfM1_)iHeF6H?I<1)a&kn z`XAH=#e0h5h9%UX)a$is-5z*ysEAT<4Ytnre91k}{@!njzb>}UO9yj?%)f1YzE?lT zBFG*RG-=3699lYA{qom>mu)cJ7rpM?x-Wz8nR8LRZI_{lV1kP6l22R*o13$cZ?jZ` z8OOg6Q<^_MvIa%wo|OgnmZ0eAJ*dTHXYkbIo!>cg!ywjGqCYW!G(K#R@BA_51k-<+ zhN0sRqd;6$q8;6gw!KE!2EwPSkKjpKl*zao>*X?i3n#WC4S4J4UD92`6`GBV-_wlT4(sVT7UJMPZ#YOp4e@Pe&?MeFH7Z1o}e!z{iL z(ql3UH)NsIh))YGsNg!9lkDgdgAx+lb;v=VKJfv%(pdNJ{Y^YNxqTObsuQ54wVD6u zG(Kh zNzS$iSq0C~vz~Z%ZkrjOHqq_K7O}Wbf48*spC==TOxmkZtFb-31D86FS9%tj=M`~e zuUl!^*+}|$W|>dc*W>z$&XLxT7Y_=5IqC^;Qbo@R(d(5?2zJDO-fCYXL~c}#cXO39 zGCt|f!gs6f?xy@4CI=}f^q={;@cTdle^w-Z^kKv2J{FENUdMDHhIHi7$O3bs)KJ?x z)q$|n&8Y-!ORH5GEP3wVs+HeByCG}^!Zo&xsGKIM%za^={}lfyRkVU z1Z%S0gt2xqqwGB0+BJdA@{HKlm$@X-A4nd7_S(c)jc&I^1;0ov6vD}W)2e>*)0_Y0 z(oLZ z!09Zh#z4R@S@2r~~>P?19a$fS029XvqC^f1##^FYEoC-0NFD z#C5aqWwY?ru<+F?H~ba99b#faLwtP2-W9~Etw`J@7@`}FhNO#~vmQSM@2EFs&M|QW zf}6C@o_#-|;D>HcSITE9)gMn;g7%5EHPf8k)b#Yt?^uvuj)jXY#bK6>nwEK% zC7vEUI~#J?M~QQSpx{rLD_Qbzn;K0@D%*GmcikCnHtSzJD$mbW=U{UihlI?bt@v(O zn6`f(?0Y(mqFiAWJiHSD*_35kGgCcDmVeg?Bk9Ny$xuz>0Qz^W8-gLWduMxFMpE+S2j_Xu*lKJ_Coqn{ zh$}IzX#Ws^vqclQn(jy%W$NW-;th&YZ!in+YZP&%Z$^@+`eZ-?+N6?VK z_0_ig2!jw?$&^NOza3@8po?JKCW-QI$Z%r{WJ=L3=B=;%U0ds479`qnL7PYKf35b) zncdkp7yYA>lZS!r`(Zn%tgx9mbAAmx%Yg${Oq8gPNLt_>T=pLv^I*Yej(ddD2*}CY;pVw_wdIB$1#7u{!0wEq^A_ORT)a`+#R?SvDDZTJPuy9x#t1 zI~MG$Hu+Y;NBPtS&RZ-g)z!SKk31b6ISx_o{@ofME~Gi>2mp<5Y|4PC7y1lV&{4tj9hu(TzcUM=07?FFWmFPU;Y*b!=48 z@gXBj_w$x6(6-gBSK!DE>)U?WY1cbl37*d*_9@*(qlPXT8B%5>U?X7{!1Q#8N-*@IGx@k69 zDi=E1=H6&ID%L1fykO=4o;Co?3Iv-e09HH(N>ThiRMN%6;}W3x?qB$qmuVCLNE?9C z1NrNguJU`Oo67S@(bCeA`hg1&HSiui8t5~M5FDGH#+`3 zl#+6HclXDn$R4`}$EsQX{wivw#6o9hXIN?4)^zdFpgK z*IC4NAS88GXzOS`W6sg^p=7c(`^AZFZI2k5i;% z@w!c+?JWZJmg8pa5sc9cII%asgmE%-N{v+!tj-z8DUx$@+}PG&uQP>tt&L+wV?L{5 zeXOwl(ymbYc?jdCe;^SzF2oa&>CD2F-<^+FQ_naw*$Qpsu)k+$@=A0aV>(WTNNYk_ zK{!Z!bHeEQrJYpCSGC5#x%3m)df5tnX3K}K`qYu~*EM-WXu z`TXjGIG2B)NAo$T$qJ)>*6zX!&)rDeYMK9Zdj(5W$2l3fDRGJ_i>{kh@f@%Apv-Ks zliXg8o(J&BbZ^1#P22!Cl4u!@ijr}zhTZF5pvSPhwibvNfr{b32mrcTMfo?f=I`Da zqCjOBNC7P(V>&e+gNOy|G0@cvl)7=ur&bTy(c3T5&IJg7#ir z%`01%D(S{8Fkh`gGyT5jHBfd zag7d_azN|F_ClKX<#trN^IqQOuGi|spx*YxAOk*Sf6wV&s@Eo!u3Jf79^s0&6>te4 z0SO_n%Kr2!j42rwX4Z$IW*gCmreW0Zq9NOJsNX}60(f?13zL_k(&&W#%KKvX4()1$ zI60$JA}Lbie&=(~pTdO>vbiBTm$Qw?H?t1?*Uk`uo3*8OoQ$W!4(BQnj@y;(;n%p} ze>N_NzT0@~|GL%t5L4pbfrEbS79aXOBxFATYA5wq0*B`0!os4WF!`RZs+=-%-ISNX z#D7(u5?NOsofEhEH=ViaFl|BarPZ4aTsVLw)}IU4T`oqohYNX~4p8-{xNdEZF2u)& zw7$OC+~K}iQ`hZ+F!0(Ri8;%!R}MEsArMZrf|t=wNu{<|Z=MDqrnj7vzM&z#syA?b z1HatKW}LlCS~WAC9KiLMA^qL__RW@|2eKWUzz zr-3j1OoJ(TXIr;!xq0PZ4d^@gv}mfTqwXh^JocMMkU5VlxYuRn&3QBKBTGxoz`(cP z7oa7l3Z`vvk45>L#Y(u_;lPJxiEs)54@dFimnQ`xt^G;x$B9u-gm`(IEou%=J|;1b z7n|cZ^*j}%v~^Y0f!Y{Abqzd453dBZ^L29aa@R0XU3{)T3%EP@)O+$m=iKhjH^Rbar#IJK-8XB(*VnBOXv<910g$u-nVMbL@F*ELIjDr7 z&**7~jXA>PVEzFC)o8-)zLmSBMJyxh=>ptVPl3B;PfUZ z+g+!-*Rrgl&W$!plR7#wHQM~XT0}3Mf-sD$IKgsL1B@m6)8_s1zqEP~C|IeZr9e9b z0TH@cJOzYp3gKhn>$8ZP;ab}(`91idF#P1$+v}qD$)LJik^o|r%oZH6@7Ykn4s~9} z0lROlyKCmk=##~gn)6kE6df;vco)Zl^fI&tK}PlOKYf`mn^%EB+OqsmhWzx3QQ<1M zb7S>~TuzmEx@>okD#Iv1@*CkPZ`;TLIBLf_@wTUjeNAzOhd7tIu3|S4*2}$YGgD6? zZ^bvXFMtL7Q> z?tlTh%d|#IzXm9Bl;@=-~YPN1f3{CBjmNK><)TChV*x5Hl_PE z_swNL{Bm~B>!xS8e|O@*)zEOLGL^vD``Z=>5n?LBr{VpC!vk_2P$xVxYYSqik}bKPTZd+wN_{^4`ToF@{JpDq1Z)uFkO4 zFOF@Nh)$Ri-)K=0hh9&dioG_W&|?`G?R{sxM;aYUmu1XMCJQ31SyIbucgU$+u z|A%;xTm&8g(D=Z~9=52c7EA#Owb;G?=w>b?0(1Q3Q-v>SYr@!!@KjM4)g8%R? z{=5K$6JgxM6FP#jy@kC@)(#H8D=I4X1Kg=&8QIG0jY}s1M#0F_vpzc(JSYYyM%aXe zz_{8bvIZi;kjx*jMtu#OY^pm^oip78`}dG#SV(2<{iSYLm@bJ=udZ!y;PqwvN!R%Y zE&^b7&*C8K3m2ZP_IsE-@M2;)fu}q?Ys+1Bi#9!71g0UJNkQ7h0aDSXpfp1>=Gmgu zPeny~B?j;k^VMvGA*x)A5@ib<|Ln=PnmntOvW~6g-etDl)p4P-kP8A)nF@j_Mn+2= zSg3wHmM0hLz-Hyq-EAP@zw7mTgQy68w(Dbu{-$hl(T*ohHdM~NUbpSsimSGjbPTz? zZJCE$?im{OyQ{oAK4kpKdbTL$`$RXVTWh*5D}K1bR|s1#?}H(NqV{epw#43)qQ&Q^ zAr5>xHkD*=BoSE?=~$>e>w!wSQ}t#yN1-n`Dk?bf+wQ~}o*2Hd)#t2eZOhCsS*<8{ zYKr`gA;nkghTSb5%YT{C6aDf|tD0KFfg;kqcP1t%I^ADjE-5!VwG@Ci@aVQ$0%=>gvRK zbS6z5M1x`l<&P4B^fdhZOsX}t6gA`+A}uMhxqZBk)4D&v#*WfsUWU2)(`Smt3Lopk zhW=+6a>lx%>5e<7aBb?nLj8 z5~I|~6LhG59k?91HLo_H;$*Y)S4!q81uo*ytu|DD(IR@FTD%=czqpQW*|%)#>$>pV zaMQ4Q07n^>S3^AXo>pW_cryn3*+iPgbT7e6oN%*e!8}<2q`e)Ydep#cD#j&D(X3=d z#KIVgA|{bzQ!yD=$mm7RKp7g(`;kZcm8;3l?^2L(iy@)w`rbZGHtggsF!44tQ@+1v zY@~Gm5#bRoR*1MFF_Zpm-0Y{P=S`t8F<3#rP~x-{zN-Wfe*WiPLH*OW%Y{{z|A3#j z@dy1%qEypXR4i1p>`#U}ZrGQr@WFAAKjf1HYTfr5J9FPH zQ{RLnyF+&-`wcl8gMhm1yvJ*|-f<8aS;U0D`MY*rxUqa-UU*_??7ApB|7<{ z(@c+C$j#7>u(_%nXGum)G@&7E-nZZg@!h%{r6b21l0LX+<9;`ctQ(I#mqz<^s@?lq0o1ei{%Z(@?< zTbk1s<@n8Taa9=fe-amW_$^JEI8Eau@XGuBJKBK4F>`~Dv9K9Qx$d#8*b7wDkZzGP z2M2o&UsQ)f>44Xdddfirj#;DEI*zRd>_mmIcal=QO=(D1OTRDJOEEu5G2lyau40lw znDg^;^5)Oqe1z(%t7v|hB*2e#E_T;CZ@9rdb>cW-#RFwp%d2$o1(- zKj?#{bR`4~ecD8seWaG2^3i^Q-M70ruKEe)u>z zM)1%eS~5%x8c;<@4SKn%nwunOPJsYn@e7>x@irkYp~#f@SUr_zF_LKmvP=}TE1VjH z1qA2T=2rQ6)*U_c>l-VoD&x&D?;q$_fC{Mi2g%#Bbh1=vSeU%pXtCXAtl$>8?EJi} zw9*gHS^D9B<6Pr&52KX%Dgyj+U4foPtI$;BY zod1f*voG4ZR9UucT6T7ZviGk1o(BW*U$Vq|ny;oLPou{qiUf@^JSH-d^&rR5(4Mp% zw=GyF6!~So&b~_>wrrsW_V&7)8oQ?WqrlWs8==j6UMd4H9bP~^XVym%A4k>;5WI&Hp?w-v?+ql z8?z@uzV*%VdR_=@X8GbeE05hXb!MFgQimtU)kM1f^>k04!4FnzKOdW=xYG;Kkn{?j zG%?b@iwC=xr>|G82#u2>?Sd~z!>SCOE|I4dPo{S>xGq~|5b&Pa58J;DyrCkDs~ z_{nwqXS>ja;eKe79OcChmCa13{2N*C)ydeHm?OiIWi=}id#Q7(o6E0qmCs`th0d29 zGL@ne)lXNo_6%5x>dwbny9aw(J1+)ih8p+q*xs)@yPC`{exdwFUXserufbKzVYTE~3In_3A^mNga6O#v| z8*Z)2_Oa}5RX$2<n~osO&25fYA@7^Fv~<96xD7fJs?QuKJ>w33#!E9= zP=AVZlGRamhT!H0zB5!3ZGJ+(!K;=C5dQa|xI_+}J@g;Rnsp4)Cisz?XqdgJ`HOjtA1v_-2VcNe9mAfwhN(mOX_}Ge0I15Z}2Y z-TFrCl?n!CRS;)-jEXsnFg|eNy9#@r1PjXDU%E|KFH_#}; z@x*SJ?NGmo+b{|^jB(WOoU~cif2$JVVg!tdz=-75A>hKrR2*kD-4@zDz=6tJm@<#; z7>+n~PJA@BBERS`F8%f}aW*_ywD{_JKoFg|k_>Ztw!6QJ$tM*P?X`vnsAE+@Y1?X1 z?}0FthfuNCki-fwB{nnSTZX^}@dF}1C$aJ|=nOC!glmu&Agd8ee3Rth1Lo+J)T}q9)`e0S{r!S2G(HIq}BE8-VK(2gWX1#S?ZohL#LJ3*=XhYIa*DP+x74~ zz@`kZJ%oCckk#OL%Sp+JGFe@LMivBzQV1t%zS?rWbPxm(p@OS~TsyPg=r|CPD52wN z;d8i>@9$4}H zQ}y+9C@HZo;ziX9&0|99$0jEQIbQf)8VR?w(s>@V+H_nBUk)3A`0fKlzw@qQ?uh?u zTC;vV5lnEa^4o7OH*fM;VLz1Ih;v+2^N^DBdavcKt}2ThJKz8HEAiZ^1u!^|za+$j!8>fN_cV36QtBUIPg_}=HMhiV?c6bSTKMhs3@14y zIa<^_L^?mted-kel!*Jo0a?IL^oh(fD-t77otEl4p-}8(wQ&yW`(|K$&JT@E{U9 z5L-7>E+JNmH$G1uu!qS?TJLRx>C6Vs@8djTyOY0u;bd)`(O@0ue)y9Pym_Rf%}gWC zsJx_9U=TQ8voNd+Y7!HZkC_uKei^#(|DG}Oq6dk8>!|uUF@24O<`57nu_z&VVRAOk z2)lS(^l)&lOS1v|*UtD`S9Dd9d0wIrnja7RBDu%X~HIE{=BeCPth zXMzMng4zN1N78RPJ8KP`6tm2Xi}jX`SWU_ty2X``5LIEMl_lG8R$huET%46qfCvi| zf>g!($W*;wx2S8LY+i^}9|fCJu(*hGb~+(Gn6X@3l76+nfuZ(WO7c_jN{Va1;=`Ow3qZ{jc1o0p-3KC)dqNJW*)d=PA~opHsaLRK@Jh zz4iwN`=K6h_4@O2bNwg`yyP!e&g7uuzH%qqhea)IbgHW3$GGU~<70hEwfDHinIx~l z0(D#2L`+Sc%R$$tPQw!4uR+8c8-*?|y8&4RoLji(-1bg`*((k4rug`1gdbRGIKMXG zH0I~<#YXz@6MlgUcex64#-$Lt?m2{bHaNtNZxLVw>UwNcl!q47U*PUdx(_Va&D0Ti zGp%NgnqC}6^>cAozIVNxzgc)QySQk^4^82B4(`UgTy^$V$>p%GUi6C)0@MiJ>NAOm zRFMlb9Ew@zee@;ile@kx3kcSO^3a*%zJcUTAQ%7}K8prVwp3wcsI1jh9`yZvHQEdZ zl-DK`ni@)qI?Y2HG2e^YAD87;*Vk}8{ZMj1e~P(b!ddw$@eo4_K;($?93MaJ#8Oc1 z*#9gk@GQB?euvO)V|%l=lX31+0hyw4ozO8P=;dgfOj#?&2mGV^+1X}5hFCBH`z1zV zTYL7G;WC=|0fAXVNo9ioie$m!SLl>%AhsPR(P&V zPCbqx%k@fJ;2AUatoYn7#QC>c;ME6UhkL|jn4Z*4Tfle8Z+}_Pyif;yqMQEq=UhMI z^T`pXRkGQjm#+q2n10-~;&S&;Ixm)d5gD!*7Obbq_7V0vBJASwI^*jL{JvgD0L5e2-45pw$sR5?iWTR@wLO<3>L+B zX_KsJS_~>0IWq(G=Y9FC?W6WnyzRBnxxY|;iviniDewbhpIVQ zKS^Lrz-{FmFHtUS!?iUMQ8ok>Ve?uNWDU3?bBD@3!gKZxh*>R)Vreqj2D*sp`rv~vLH%sE}j$tPkKCy4#Z+JAzyzP?_fJZ@w|ubQ?MR!^=A3B;W3 z>g!BQiJ<}W^4fRpWMt%Y>KrqRb3oaJl+5ejK6_;#?fO=-^ZB~jn=b_u^>m@Nl{wcZRt@W0D$-OS^gE$F81s+`4hMLWLSNQ#c0c*FewYKmhP+Wt zxOZkIMLSM*Zl+F}ijf(3QiDg9F6_<){=>MPRqlS)?eAYOBHA(E78bw)rEzh>^wSzN zf1U?-k_0^u#lK*FfW?+-^K%&}Uaf|$Ejl*bSqg8JajPk!{T9}hw~kGls=5ZAr~5L+9l@)}{3CgJ3H>>R$T}ql-Pzq|jMD%pK@Ah0`d-(U?nh^rD6K2@tyf+f zJMAyCwLabo`PoV#rwwV6E^W&n~@Q89-h4%zMd zpT0uh;Oi@+2hQ7GKeV-Z8X7oN##W0wh>_*BT3}jTdd>A?T*XlJUv#3|T&`>K9NY;K z7ndc2t2;yLbc=eg!}LhXH43!6-F`_lZ8$E-T7^+!{?jGXLf<$C&4Fpkn*SruqRe8+ zKX`})+@pUwkYbPisR;k0*ZzTRg1$SD>!PE7V*GvKrPY2>!M(kUDyl!CMiFca(XCTo z2Mn}}zcn!cvi94{4**Sz@AWJ#r=SLw2DokSivkP3-1>TpWu0bioH;5>Ovr@k{xuy7 zGZqk9npmf6r{M_lpKJa5BkQnnvGTmY`5S*lUo;Can4FlHavgVg_ph9Cf{hg+-}mva z7xvx(d-Kvkj5_xW!pr5~mtdX;{;R16r83=q$Fu)^$Ce*{w~w&fFY-syoPgf`@#S0E z;UATE8t3+XJpO$Lbi?V}UnLTEr0m4x0HyM({r0_XB`O+y2e%;s{(2M^ING#wckN%Bz?SU3aFguUgNmvm&TYvac~ z1p|{+XV)Arh8gZ98MwL}&hDT2RXZVPGCi*H5ltCE-i;yJ&CswkzqWk^+TYj9$yxcG zkgIbAgP2np>j0=eC9E4@MGtQ%<#S^ABVm$EWhjhs7q=`buFm3l(>2c}Oe z8*_8~uppzQFPhU+kxPzz{F6F`))Y_)^Ihd(cHJVPhd%VRvo_Dd4}fY1W-N0gxIR7e zXavH+^b{ZPS+o_6_5msWeYHRq%bx{*VE)^0!%ga7T^O!*eq>f5?|B}!zfB~2b0O?~ z+%MnYo@RV0a?moKW^Cvk;L`a>Xs`~K2O-O_!gU;81cXf(tnn1I%aM&N>O1ce5XoA! zuf^o?i=$;Ggvle1afXZqq#W$NdJ7Ctjui1Wdl)kfKa?LUL%@t4er=(Hqo(p97HUQR z3&4JU_Qi2lUqi_8^t82G9YDPv?ypAcDL5{#cYbX7dW9B&anG~IX&YDgnuC%5QK=8;P)A3?4UG&pgH5BsZ!sh zdYo4`FNl$UjaJRbHlxkV@Vwkun>eJ+G}-gsf9EF7a!c~cDB>9J1A_Vsk;OqwgP5SG&V+}T7`)?SMAvB^p_Z#7Edo}a)koSdhEPb|}|&?_{X7k)oAQnI2TC1ip?^y;Ca%(%0jc7m&FbhVfd z(+7{P15=5yy2&{IwIha8$&43e;Aqp6??v+RKeIw#Tg2S**9@OIS(sywg|(Avzbdn> z&&)3J<2JV|V&d~9oIfwDd0Vki>qL?9^#Eq-oTYyM0lhUP)Ls3-2iTKG$)mYiIJ1_Y z$Qv{UA&NTv2K<6vK@x76-|C!<<&5g$rrI_ss3^x@PO;~o6Jq_S@}(U0jenO!{Wt|& zr8?DDaLf?trj6;!zyL8&da_0s_=St>g}r4X)(Go;^M*#csGy*;t54$Im()b{D%J4_ zN@0I=mE$Qy;s7GJGZ#<;S!!^G+bn=9z~lX!{;z1h4IdoVAT*26>Qwgy)tk1RtzSFN z!o^coa@l3YIY*0`j0!fj;(o5N7w7S>wFH0o`3)b0>WhkGP3>pSO@nz zwV8z(`MDu*7B1$8D-Q!F((eQ$e@$vLb?)znBndd-pn%pcbY~9K)JunFeL7VfFGzXa zwx4b%zk5I~?23vxIx|#r*ewX^V7L0ajO^TWw>evaM4xa4QxjUdu|M15 zCH7gP>?)%@O6 z`i%W_H0D=@Mf~br$K>joxdA5sq*?*52*@wT3vMUDXO)(n#u6nnQy&@>Y1N+spD;G+ zI5nj!LS((hPR5hIu&_pXs3qQfS?1-&T5LgZD|r;{5rv}fDer?f+|AtFm6ZJN6V4vj zh@|-j?FzdXJ90R(^VZ=jVfgve&^^tf&i?*AVQ}@!(C?%=-k&#Sj>^)EH4T&w(gWiWn#4-r zfd7~<#Od7|+p?)|TU4HxByJ?c#FsmJH!6DbL4_~W@KA#{zO_eX_d!qWPJJ6fV!xLF z#e-ZBieV&PmsfM#TR9&hFLVDM5*a_=(dc=0ifiK@uID$q1w$3&e2^g33vR&Ck-&Le zK{k)+v*Qgk^6;>|pMR^P2x{Rtn4UDAms`Cs?6qgQqLW{y$8oxHY*z+Va;N*jjywv6 zdTJ9V2USpKUU;|dgS>iAjJ4u6&k`%mvdfn>ILNl!_h+NKe%W2%ec~OK@?76^GevW7 z5=>Y6Nf9GYk02V>to>MeP~Do-b39}k*}PJlGW@nVCeCUX_5pZ16E)3(nbuk3n)H4@ z4GNlFw!oU62Q**H7_JqbdH~aL|RJj@Sm9h+(t_}%qO7v+7%{S=J4ASC?r5}v}cZG z6sJ`><@$Zs?L+3?oP+-O?v-fsF1n|}^@r=3 zjb{~eBxpzyt77_#NYz`~8|BB1j>)4>D9A6)h2)DMKQ~GA2DCh{^-XFgtZ+Gp+EPgq z2WgrJI&BFY*TyjOr&^N?&Nio}zKW!3(S4x4VJ=>!uJUX}EkWecMNOB-2)^@;zmmd|I)ibE}}!;341Xi{6Ag`>9C zLlm8L*$te50uTpvH5Zt=zczu zJgulgK0q|0=Y5v(<}1f5cYO!9$`lU2iVCONsLQ0&_(!faavs7U{pDqFFrcvhSorUo z2OautoFg0;wAQNDx=qYJWk2kT=}GD!bKgFbPxV67BNO4_>dL&>h<`^?Ss}?Jvz}C% z%$zX7?B0a9?|V83To1&6Fj1&BO%c2GZ$=`DN@-k=f7m_Gd{b;;WaCS9l>c!1?~J`< z2DjbAe8_Ii*`62TsG=^$G`Ifkrg^emNz1BQE<%L{oWd^g|8p!^3LHVi${&+M;;z|J zE~e6YbPnq9TDziX^P*@^^S!n+by!=sv+g?^I^Fn>OeGi?HRr5|Ewo%BuY=Kz=Zl7? zYhUYhQ%4Eiif7amKoRiEmZzSTaWct6{Mk)kh@@q{WzFljPjlDff|QecdL`2vce`7j z{2#fosyRP?@ne%?=|cQx;Q*0h)E?K~fybgHSC*`YgR z_MC_`VmVAW2v!7~ZNg48H1wj`S_yFpu$(;6EXfz0jL!>mjW!4o+Fm!AIm8ETxDe!Z zXI0te%}vrveN)r1wL@7MnRLJ_P98J{RBtdT16bHP>Lv}D@(X0&^n(zH=o3c9yHKL+ zoQ&_8VTDSTe^hT4Vses5Ak#F`JhWiiz-BM4{&E{OCCq0!8d=e`p~|C1)A|R_^M4Q` zZ~<6!;0b*DwaL9yE$H*LQ#W&*3xV8XRI{WeP3AAdG{;5M z_7>+tS$Dt^0P>lesV>}(xC?YhV7BIpxtwROO)#Pp=IK5<u56`NPvOYgO6y;Npr2Q%>4@S@NHq-5au_*7p^Xc%{eV`z9-^9I6ARMz^5 zJj=k)94|$wr#GOi3kcJ5N((TIny-P51KqRi015H8verYv^jP`^?@MCoaxBep{$cM- ztBj+eO0>0QH~l>x`<})d0AJu%qW2vgh-H%3aoN=P30FhInwEj>(qSt8_04s&?RQ3# z!4>7i1*Oi9o!7I%mzX;8Z@SwafHvVHWwx{}0IgP2X5^aO3GYcls^Y+(+Qa3Jj*JHs z^WGK;x$IsWd6~|aK^0L0H8#F?8K=B0<7%g1?cpWk+S;F8ql6D7L2oedy>i;=hb zQN<_e{BI|qMb8}T4wa*HU@wW9ogQjyo8P6hf!m?0D*T>y-oR^l(!@3D)O(3kn;5A6 zo=5htS|Cg(maeo=?6PGv#RV**aN$ND=e0hFcmP`SM&R8VFGeAhhasa--g9v;gGtaE zONs7ZxNosZN;5iuSRS!j?cULc%H7R3b9MlV9i}uxOss6@yGa2rVGPiS>LkcpES18~ zFR*zKOzVm4SFa6RY{s%omKNfusew7o{b#-(bi==8HQev4YT*D4beptZQ!wBJ<@L%H z7}7P!I=eWuJR&3Iwp(moo>N|$1^Ym9=aqm3=z5@uf{d2U+|OS@c0sqw%^wNJKUJET zm~?}Tcyn`sHyO4cf53f41Ew)}dRkam*w`>9c@Zn9b1|AN9%AxEYx)I=gnGCdDu>?fJlID(%f(f|G(PaIx5Pr|Mtd0Y3Xhd zkOo0o0R^c6q`RaBq;n_%DM>-fAp|6c?(Pujk_PD*x>L@DzR&M{&cElZ!{QItz+&o} z`@Zh|{p`KJ7usTcn^)t*N}L3eG^11uW0KtC>C|n+Z3OY(Z%=q?^6jDFp??cdyEZo? z>Dce@SKT6Q|E@>qLcs6wUwxPOA93janKk{t^4b0m-S4+Ln{h>iY-eDQbl_{_j3JW# zYZ-815u-8!oWJr8GDW*9djKU)SoVsNWqL)oUu^Nt!mZt`jFWxi-0#mzns2Ikaq-l~ z=-^DxlL+1wI%YMp5{);704Qw7O=Mk!7{&23PBl+-9->eP|%#=BPOa8#%tH{jv>Sl+eiEt*nm?+m0XX~ z*VMGO+8wr76Q$xT+bFcCz{tUaSQ~kZpElr_#dL3-UjEbKCe%MV&04#ve0ynBcRK-L zSUz1+9zBM*oZ5Pyc7cub!hoXKCFoE1`L1jMi=64=td2Hk;n3p|X3RZC69%lZ4k?^qomvd(n^Bz-J}^_BJ}MB?{DJn8b@}_kUnV!_tFJTy zBzb{{;+wpkGhvJ|`n}Zo0eOmIk7`W?>$^Xsu>+UwgsP~vCnC=SOc__kqFe|Zh1z-^ z4f0i@-Zh{`^EDh?a0CNPZ*HU7zB<&IxX`09$KFQ8V)Hq4A;x zep$0DUF-6Pa4jFvJ|%i`&gooBQfymm*@2&J_S2)ov}B~FPmNV|uqd#MrQ8G!H3G}{ z?dl})K@?Dj9HvbB^T_hSqhI6Pu+_0o8LX;C_j=KSp5qtgSvD*CM&|_d+WIvAy>gCZ zb8`M$EC6$EsL9-38K0BT3u-$@bWs)M73ygZXJ?w5zIz9PM#wRHz+@O;6xupEk-XmV zJ!;zOpOd1!&wlJ*z=$A?X{1010%P2t-F;Qlk{aTN2k0tqhgtKW(a|cPZGP{x#6AQ} z!AwoD`VZ8eDu^4EbW{B52df=}vnj&aDB98CK|6UX4PLlzwG*(cS&_Wd@mRCQBxYDn8>uv&hlVUT5m!KXu zodX^-@MAUlZRt0p9PHk+#+>hW7YR6OTiQqEA^P@~?#EYt*f#gNIav_Kd==v9Tl^2B zo%7?8>gk4p+YPx=8c6i?wX&bHWvHt;OIp6}D;;_?u(hxU(z=)HOEMdZtCPk?KgEFp znstopUwq}wgQX6kVD5~tvN8@KXtP4DOBr^e6xU@G&Plu)U`W!xGxR?jOheq;O`9sHk&9<>JKee?)zKiJm`4v^&1i7riijy6{lmRoip^2V4 z56GKB-SP|Rw#<3r^4#TU?}vr1@l?T?YCT=8$2oS;J^B`J@q)lC^(~e!)=ca>A^fZfXUXTgQiF~w4)_(tj>us%XbW2rZb|sL{vDN zxhRj71<^T?(Ao^G$bi{fj)8W9ooc|d-0zO#=Z`STH)^uW`Bt5tTjS3S4S1WZq4ZYu zElWI5=C?sUUmum23o3nLTz9N2mi{i?5HnFtWn=d{p0rO+#(4hi3k2k;wPUsRG_=(C zVT$r?euiq?MT^5fPx@`@iT+Zw0sh=eFJJp7a6)s(rfNHhDDa|7>>2DC*f`0-_CE`Mghwn{KyEt32dLPK5mOZKLhN~^-2--?#9BS3)DY{oZh6wsrP*Z z9FCT=Q@7cepPu)O3{;hu)2^Kp8`QzJrJ&lKMLvfQC%1G#kraS9TzL5x3S8#~e)dcH z+x^k2JI$aJxbXoca9_U0O%6>Sw;QCybek>V$GCbnS{;5Rce?J-m}{=(>OSc&1ef!c z{5p*jHERtxFJ$B)EBlu)n0w^SLI}=_xis}48+G$DP-1nnz2xJ4avq-wyLeD7E6sG7 zp(qw4LLuZ?UsB@k0KKRfpRb{Cb{?1mDOS{uUWacN)M=84IShirn;mRBpU8DF8R_ac zi?U|hy%I6w(c*E$zz4aSGjO~IEp?LP?CMC+-9ZMQGGgmvr+my%O&#`}kzI$4)Ss_| zDQlXaf=6}2IDjEiwv*8We@_Ryh?BKSsbEOru8|Vp0#%O`G)ZB=8sazIJ|p|_7wAIV z&nfqx1&voM9EfsFYf!slbh-YBkk&H3Xy)ZoG0!@q$Z796s~v+iba#uJjnl-Z*qqLte%!Tq+IRA^3!~c&_h)J?7fz$Tcceoz@B1dGjxW# z7z5ZK0?fv)_CG=55PX_A{s>IU*RgugWD-g4{bXXuY(rUa800TcjWH0p91G$cw5_%W z*K0FLbli+(wuX<#gePX-C(q`R)&!g2BXYeg+?I!9$u+UuekWoKO{i$T{UI{)===WY zWRKsUmS6n*C%AFAceRxDK)Q|VwlEKufOVy2V)SrGuH4Y`Cr`{fJD(Ic(R8=c4khU( zrX*&A9uyfcw?~YUC2)lim~@J153+;AS9R4fuvG^wS_C%8b#Mmpf4GFw95INDS4?U6 zs24)}zQM+GeVsIDgf#w31U=NujGu!x_I&PslIJ@oHZc~;op5dwgWles7@vOD!rU~U zZP_rCj6a^V4sRngoL>lTReosHS@H?Zm;v;kXri-`NeMRo*cI2Nzohip5jUl1}Xw|VpK{uEJ?}CZJwjJ1T8rn zDXma5&@@3v9Dhs9rla$7bJg0MZ6aINz19l7^oy#pvi{7TzJRUG z;=sRZE1kv+xU3Qr@S384I_J(lH!6eXCA8nx05@3^KIN*7*!U8sc6CtFHIUR0ybL7X zM2vb@#>begQbLmrF)F-vv~1M!)ma>#!lEAvLAM*OuYmYnP>z$<2f9I#LQ*M-Dm0X- zWTdgJq5O) zL_rK6(0OnTpC!Jyuzv1Dd{4^3?cLF64ReB~jt4Qr;EtWy3Q_AGZH|R+uHU_ajIugJ zypFcMsKB$k2J9S&*5O#d*{P4UT$9{hPq#cx^VBvggj5lDiB{&tjg9raUf|xiKSJ;% zHadm3Y@ZNwHCNAg?#)KC3OM;9Z^^3jlO9+ z`eL6z73m;79XOZ|2b71s{9+UrndEpw+X@0{ z@8o=J_YIl5At+${Ino5x16_fU!JI}Ppf$r&pv!{@zlo)dk=cdo+3YsU5kLpzI?(LtiC#8DGi|zJ=da32@ce7<4;@ZqsB|?BiL$oYXnt!O@z*3mW%}1n1>90| z6Qc*CWtYF2idW1N?6yOxC)`%Yif>w!*mW9&id0}Cd?05XC#putVY;YkaEp)C5FE$5} z7zrvG&oKdyj&II^h4~4zJr?kje;4K8_JS0)lRTRmEVy4>2MUlnpC&#%lRUO*K#$Q!bp)1#z%w?8 zd^gDdE@lH76M6vIuP!K*{4q920berQ10s4jkxJ+2w;g%@*#(Xj zP^rrG`<^s}+mr-!acO4&#mxl&El}hfv`>ETy|EZ){$g=|Q%7eW^Lq8*LVHSRVJ<%1 z*3ilUN(7L)DKcyPl&}sq4g`qh(_H>qD;3!l#9whJ#3pu_b2m^@dSD_MB5y7)czvPqa81 zCQ{%6I$=o_%(n7FmANNA-FbQZJeBjqJ-qXY@ri7KFoh>_3SKIbDy)EXXR-DKZjrhH zD8?)z(kuLFLQzXG<~cETh@C~plaFFCwS=iWf_y!m{wUqG7f)6v(bL5Ko`;71r_Qad zjXu6e*U{Sjtnw9I15DJj>>1_)AWLkUE{%X@O7pn+NbJv1C~$6jf#F$i!7g?XF9+?d zWkd+JMR0h00LHbse6;MoA1H;rHz)Q-1iY$*DI%{=aP~tC3=~nLxi{vngTz4nAviJh zEgWQJnE_^f&`{ll4iin%_HFK@zHt|_ghQpbnPH;Rf0dhv3QcIxY@o0d%i=+B`BedlYU z3W~788whpkqgeqIK(t_MG`Eu)M%#(JSxVA<@FK_>$cF%Wnb3Cews)q);Hfz-yC+~I z1-bJo^!yL+6_68{n~E_HOn4H>;ZrnnN?j5Cg9I0-sN8`e-HCB0{hxjcO(=Uv6PKgc zKAM&2Q6V=Nuz_NGeY*32l8nlCj_+9|O~^@*G(!R~iWma2UV#z`EDy`PFB`zl4R>SH zR{Rc3*&8&Cxx1HM5<|Fu1#i5MMgme1}e@=+jNw%jzXvF87Cv&JTYFVB*SmbKPey)x$KgFaQl0FkWe#EJ zCjMQk#PLQdq6qiHG8_uL$Chl>BO4M1g6_{64(4ES2JYD4K$yQ;>vv1^z#aD zX%qSU5ii?pIU+2=hqC%!?z|OdCG? zQ4$znaUDrXV$XN6J5`6n+TPoiP&Z|b>^x>!0#@Or>K@;|EblgG2wQADL6e&~HOCN4E zPAaeeoPho)Sv;FMeR1~c3C1kR)o&0T4d&xl`vZz;Fo94vH~!u0xy>saY>F@@k`EGx z5AFf~*usoQ@nk@sS9OJkG)~E06?}k$`dZMpFu3<) zHDkOHA2Bx9gS%ci^I@;ePua5k5Xa-y_4^i!*YtQKm&>EQzfyxQEzh7G>)o5TV(`Ao ztptnPIv_qCvfY1OG=qoJe_Ge|H@7r+`@!GHO@I>qQ;udVh6!=};c*R8y{%5ubI(@F4DYIAUq2|e>+Uz9+SZr(i#}Dp$$)q-> z+sc?61!9OYI23Gn$|7?=J|S@yu<{>MJ36UA%P;gTikbL$7laSCD4p9;7_!C$hG(nq zb(uNOEYtvQV=$}8yH=gsR+epnO(&_s8V#XSYwgTP;FuMQ+R&{$Bk+z(c=xQv@Z#8T zQTdj;{Ew`@n~QX@Emk(peVq9HkR!YsQB^>)#VQo4*toot$koNq4C{(p=v^4bLH$yj zrt?+3r73YHoI9 zH%1l~-5-a(>b$@$8~#oDR)ELDY5)C{728VR6E&OhtLiE4tYQO1!UiedM^+IMn_XEa z^&q9ZoppGl+MquJk4|;W4{Kui*k_@JQ;WIhIbkPXvC*z-3O#xk4nQB5MrDXQox3rb zv_KYB%3yl^%l!P^xYiu3Cu?I{5cL5!^BZ~d`LNjy1=h95KDNDApOAvdeKRtn4N+5h zdZjr;y&)Y*rlE)k(az1!U*D%#30enx$&Bn}mh(@DVctmTSB))*zl2|BJT;pDp(Fpj zDo=-w`Ax8(6@w3=MovoCFdXAv!(4;SKsiu6FXMP~@6rdol3az7o%7EsXg`eBI|9_zT zW)UQ$)ot}{eNBB1BMZW^FPK_(d9RxRRW)kMI-q*5x^a}bxDhis?2ATk{)$>hXyHgC z=T}zTVLt<37tsj=fg_}yFYXx@vacWRKCAm#L>GXT`CtERy4VZYUslSR*F;UBPX-pc zo(z1%oZpV==TLVJHo<^FCruCtWUZ-($*$X5G^Xsz`PCzvO_+XilqExv{-f7Th{9<- z{p6N7)z&dv&-lhlxo88owjvreY9Ny&EPS zA`IKi#_=OHOH(P{M_$R>47?yip$ZA5Iib7A&hEUI`Mr5NtnaWwvL)CNPOG2z?PW=e zO3XdGmj^ktkae9=`4;3uY+A=pr0WcYGGvuL9*i7{`F!9NsrpvcZyC1jHKMk?c!Vy# zJ4i9bt)&M-PDi$-%j~?9sH-rtBr1RJkC!lN@m=d1&^*=!QJJxo!FF@?-12^IAA>RV zf^wE(S80`-bS9!sXjp{*o`2d0J_h|dmZ+4_>9%XUroPZfHtS> zji360Bw`l+dy@?E*$7vmVQJiPBIZ-(9;%<)7mz64h3H+wv7TZHs0+NTPs9DU;y{@c z5(Wu1mVK|78=L%-OgNEN@C%pc?_bS>?L7RM8jyO}x9z^RZCeU!ulGK3xK_Z&pPsAH ztva)lu$^)xlx8PSshcT>Y|r=sTnFIGkZb*TJ~xYChs^U&^VC$^_1k}Lz56BGZWek2 zHVN;4Lt#>JF7p%u1j1*NjQu;zJL~1R=9{nc6XQ?$n@X!z&h->Hcc5g6&$b$7MrhCO z6c)Zff63$>tmB2Y*aZSV0W6U>zSblu%QC}srqOuWPxH?TV61aESUcA~qWgou>Znk3 z`~h{!j`y|FbPdBodwy=39Bpi3%Jk&k(HfS|MYW58>h5yV`G%qu(<;@vvZIpGr1crv z9wf+0#%Im85>Vjo4UGkz)@74HuNGUaM3fn~j280-K1V(Ow?jk0WD7wT#6>gdp| z>3lh(BD~pY7Pd=ec{%H$*5uQKx8FeQ(cg)7x8-523H}=L5+`|`oaB|KwI^tD@a>*& zw=OBJ6Yy?Il_3ky8a+w^0q9wAC#~rYK_eZ@^RXL=leK}X+#3u*OpnaHIKMnqkTkhX zEQ=%oB**>~NI%h~nx_ltu zd3vTVr5bPwlgwUr{>fTv%t3CByvjzuIZ*B!KJfqZdlHaK8;%-y(LAb80SzJlT8)y& z-Rm9@%D~nB)7Z+OwiiD8n}c>|(&KVH2%x+rR70w&LDvglB(wz2J8Cl->t>Zf7_7Q- zOroA47g=ae-eSyfS68+`J*bnIZ-#dN_=y0qK*?%vx|o2N?ECU1&10eDetm3eb}-3{ zkYNHLNj(T?xD>t<;CGT!V&mZkAS=;Gh%s0?9JHRc7!Gdl*NV*BTh1bJ=9p?oMH-tM z_-C2E5w-qeAlompcUG1)Y0L!k$u3>JEBP0P}!$6W9|=3)#2eR)Lx=4NUTHsqFr^*Pi+eX za^FEx6M81u+|IsRs4SvA+Fty|Py>h9Y;IzPgN(EwFW0qh7I>e5<3F>&5eg&19yp5q z@|BMsJ_21k4E>pHT9%G0K>stClVgE_v=UQ7~TuYo&spA`K1e<~ZsH~mUN3Dycvm2B7 z#?PjE)z_p5o3s(|SOhT<7PFufNd~JnW*08i*Qe?HIf%!4m;r-MnN6Q>LK?|VQnW=b zj=K14cWt8~FJ@fp(~tnG5tuA`Zvou(x*GGCb!Hr&etRo|*_pI#;$fJ??U z`V4uH0I8K<`SA;8`#oPn2kp4O#au;J7F3kvKzRTWZD0z=eDOOf$A8uzG>(g;7=Ej% zkStUxC@RRXFOM-$U3I82Ut6wPd<(*4aDq73@d4bsPplSYprZ)t8q=+%^@5 zAqvf^clAX0!lDSnLb;yRFT@FFjUqEg+>oA0k?t@Q|smk07I;}(LF z^TgyjaFYw{CT$6r+sho(9H6UHQx{{%l2#*bUJSE0y^orB!AaO{#DwTS=U^`IhVb_0 z=AVx(2@g1l9m;Iu?`nvhTK0WrZBS$9b;p^HuUuQXyop3{=a&sbM-;TVpS$8~+j=PeaX8u8Cf)SA^W{m@bj?9N~YLhKX@ zGIPyBO+AgF4p1}3$9tC=VV#5c8wzHjJ=-oq$u4zm+xyL%`>s%_Kz{qUutSr`E>=?b zhbRQ!)Jv{l{vq6_=|V^Pg-Ypkov4=7~w0g>*HF=BHeLGxNA^&A>m$R;i718q{DDcG2u(A5E^+wMV0^ zpQ`HtZZIdOaC{?NQS8{$nf-QT!y6IK<2yFZ*>pj~>(*IIs`tX-s<$_vPStv;@J?u- z^VvGfkpn==y;BFbkHJhcS-cIW8K=y&#j{>L3eMJ*Tv zl-AYkL77X`tDMdzatrlSx{%uo=n*Lb_ta8i5gjJ@vK40YzHP0v+)cK7hshp9M8{7; zMa8%YchTUr9G@XOGZi-nu?g+VM|vLEx-~8%hNWW1y+9t99PfE*#T^RVzS|;~SFB9j zts#jDf<7Cu&y}~}WrM&~5W)24V5_I7@pd`~vR^nzdxJAR(|18kM3VIy_D&wmrb}ct zxSc~KO;{Zbny>xG*9>$nl~4X-#Hv~WIdk`Mb8nxln+Omc2eALwewxjNOu#mw- z+nu^|R+`nA`#t}lw?-}pqlJT+Ls8*IdtBM;ro}|iJpjmxdZN1Uwr!{L6wl4`I*^^c zwg13;P4&4=XVdYH^y!fE>gGkhZU9F;`FyPb|D?XxHRZFrdTR#{c}g8#TpWewC;5FT z&zDmkKfsXlx0)|NQWg0)$Nqm>2Ho9%{DJUh?esRkPQL5e8s(k4TgT@(RAMQgW4ly= zXKvO9gbP&Xr;}-iQq+xjTx?}lM%e66v=8B%k801h&@-X_x!ImYM&hfHbnQ3&JnO7N z<-2e4jHFHBu58q6P4PImHNl;G2^L{!ov$)lFvKza&}q}@9`&fT*rCPS?2aV%mnTm` zvXfn0yt3}a)V^F@`m*a?-Qg6IbL!u5a!jTk5(ydu+ku*_b0I_pGU5wOXNIx`IfH6XiGuP{rrr4^?md{R-t(U)AE#f$UnF;zIL60ukZX&T!`%8V+z*LUsp@D9 zDs690IeU|<4zF<-dn2tW_^~aBdAL3k>TkIpq`NKI3N;bRbyWV}QlB$vg zfuL2xjW^9{(MIoQM1;zr+rPH!^mPQU_ET;|K&Q(IfA^JgVO;d@>xm`BH|6@p7Ts3? za*!ml%ikHIvze>1hUB?R*eV@v%8)oUrE3Ic64`(Us5H8oaOF{#M_fSxnL#nZvjUO-7uDLVn70pd2 z)+@>cMcZ7vuU_rXL!h$_gN$k3HK*|R!Y<+F=+SdMggRta5v+o`LUIv(%b#9Qi>CBh z4RsadIW7#xBF1fr${otJ>nIeH#XOeOWk(dsjJuk|Q9sj&zHfk$uKh~3>v3Y)(5$D1?IYAw3xRfew|s@UpQ837gFCRIX8!`5G=a=kg@`gj(RNJ3F;oX&5h@rfa=u zD74yf29G-XI7EB#>xuf)9a85A*{PL@>AC3_-jo^{=O2tRmaa28ye_`*4n1~Y%#cGz zK|zUqJbvdjrmilr_+wSXm}ldl5Ayh79B6GXbQ6vZ$**Configuration Profiles**, selecting **New**, then choosing **Custom Settings**>**Configure**. From there, you can upload the property list. +To set the onboarding information, add a property list file with the name, _jamf/WindowsDefenderATPOnboarding.plist_, as a custom setting. You can do this by navigating to **Computers**>**Configuration Profiles**, selecting **New**, then choosing **Application & Custom Settings**>**Configure**. From there, you can upload the property list. >[!IMPORTANT] - > You must set the Preference Domain as "com.microsoft.wdav.atp" + > You have to set the **Preference Domain** to **com.microsoft.wdav.atp**. There have been a few changes to the Jamf Pro UI in v10.18 and later versions, and for the Custom Payloads. For more information about the changes, see [Configuration Profile Payload Settings Specific to Jamf Pro](https://www.jamf.com/jamf-nation/articles/217/configuration-profile-payload-settings-specific-to-jamf-pro). -![Configuration profile screenshot](../windows-defender-antivirus/images/MDATP-16-PreferenceDomain.png) +![Configuration profile screenshot](./images/msdefender-mac-config-profile.png) ### Approved Kernel Extension From 80547968d0adb59f8ace733b6e4dcb16c85a9175 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 3 Apr 2020 09:27:18 -0700 Subject: [PATCH 08/33] Update index.yml --- devices/surface-hub/index.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/devices/surface-hub/index.yml b/devices/surface-hub/index.yml index 668c4b4a04..249deba5a0 100644 --- a/devices/surface-hub/index.yml +++ b/devices/surface-hub/index.yml @@ -25,17 +25,17 @@ highlightedContent: # itemType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new items: # Card - - title: What is Surface Hub 2S? - itemType: overview - url: https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Behind-the-design-Surface-Hub-2S/ba-p/464099 + - title: What's new in Surface Hub 2S? + itemType: whats-new + url: surface-hub-2s-whats-new.md # Card - title: Surface Hub security overview itemType: learn url: surface-hub-security.md - # Card - - title: What's new in Surface Hub 2S? - itemType: whats-new - url: surface-hub-2s-whats-new.md + # Card + - title: Manage Surface Hub 2S with Intune + itemType: how-to-guide + url: surface-hub-2s-manage-intune.md # Card - title: Operating system essentials itemType: learn From 3cd0d47fb1afd1b59bc8be7d7c5967bd59a68930 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 3 Apr 2020 09:30:14 -0700 Subject: [PATCH 09/33] Update index.yml --- devices/surface/index.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/devices/surface/index.yml b/devices/surface/index.yml index 29bd13e5da..9266fd42d4 100644 --- a/devices/surface/index.yml +++ b/devices/surface/index.yml @@ -24,17 +24,13 @@ additionalContent: - title: For IT Professionals # < 60 chars (optional) items: # Card - - title: Surface devices + - title: Surface devices documentation summary: Harness the power of Surface, Windows, and Office connected together through the cloud. Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface devices in your organization. url: https://docs.microsoft.com/en-us/surface/get-started # Card - - title: Surface Hub + - title: Surface Hub documentation summary: Surface Hub 2S is an all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device that brings the power of Windows 10 to team collaboration. Learn how to plan, deploy, manage, and support your Surface Hub devices. url: https://docs.microsoft.com/surface-hub/index - # Card - - title: Surface for Business - summary: Explore how Surface devices are transforming the modern workplace with people-centric design and flexible form factors, helping you get the most out of AI, big data, the cloud, and other foundational technologies. - url: https://www.microsoft.com/surface/business - title: Other resources # < 60 chars (optional) items: # Card From c1fb0e241bb395e660c953a4d05f0e7ef1c86bbc Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 3 Apr 2020 09:48:48 -0700 Subject: [PATCH 10/33] Revisions --- .../microsoft-defender-atp/mac-install-with-jamf.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md index bf3227d7d9..5681d81f0e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md @@ -15,6 +15,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual +ms.date: 04/03/2020 --- # JAMF-based deployment for Microsoft Defender ATP for Mac @@ -73,15 +74,15 @@ You need to create a configuration profile and a policy to start deploying Micro ### Configuration Profile -The configuration profile contains a custom settings payload that includes: +The configuration profile contains a custom settings payload that includes the following: - Microsoft Defender ATP for Mac onboarding information - Approved Kernel Extensions payload, to enable running the Microsoft kernel driver -To set the onboarding information, add a property list file with the name, _jamf/WindowsDefenderATPOnboarding.plist_, as a custom setting. You can do this by navigating to **Computers**>**Configuration Profiles**, selecting **New**, then choosing **Application & Custom Settings**>**Configure**. From there, you can upload the property list. +To set the onboarding information, add a property list file that is named **jamf/WindowsDefenderATPOnboarding.plist** as a custom setting. To do this, select **Computers** > **Configuration Profiles** > **New**, and then select **Application & Custom Settings** > **Configure**. From there, you can upload the property list. >[!IMPORTANT] - > You have to set the **Preference Domain** to **com.microsoft.wdav.atp**. There have been a few changes to the Jamf Pro UI in v10.18 and later versions, and for the Custom Payloads. For more information about the changes, see [Configuration Profile Payload Settings Specific to Jamf Pro](https://www.jamf.com/jamf-nation/articles/217/configuration-profile-payload-settings-specific-to-jamf-pro). + > You have to set the **Preference Domain** to **com.microsoft.wdav.atp**. There have been a few changes to the Jamf Pro user interface in version 10.18 and later versions, and for the Custom Payloads. For more information about the changes, see [Configuration Profile Payload Settings Specific to Jamf Pro](https://www.jamf.com/jamf-nation/articles/217/configuration-profile-payload-settings-specific-to-jamf-pro). ![Configuration profile screenshot](./images/msdefender-mac-config-profile.png) From c31a5ba33486b81660815b9829d5f76d7598813c Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 3 Apr 2020 10:02:54 -0700 Subject: [PATCH 11/33] Update index.yml --- devices/surface/index.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/devices/surface/index.yml b/devices/surface/index.yml index 9266fd42d4..35fcd3cc7e 100644 --- a/devices/surface/index.yml +++ b/devices/surface/index.yml @@ -56,3 +56,5 @@ additionalContent: url: https://support.microsoft.com/products/surface-devices - text: Surface Hub url: https://support.microsoft.com/hub/4343507/surface-hub-help + - text: Contact Surface Hub Support + url: https://support.microsoft.com/supportforbusiness/productselection?sapId=bb7066fb-e329-c1c0-9c13-8e9949c6a64e From 09a2187000dccc8736d681790135c07318e60dac Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 3 Apr 2020 10:23:06 -0700 Subject: [PATCH 12/33] Update index.yml --- devices/surface/index.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/devices/surface/index.yml b/devices/surface/index.yml index 35fcd3cc7e..76ed640229 100644 --- a/devices/surface/index.yml +++ b/devices/surface/index.yml @@ -29,8 +29,13 @@ additionalContent: url: https://docs.microsoft.com/en-us/surface/get-started # Card - title: Surface Hub documentation - summary: Surface Hub 2S is an all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device that brings the power of Windows 10 to team collaboration. Learn how to plan, deploy, manage, and support your Surface Hub devices. + summary: Learn how to deploy and manage Surface Hub 2S, the all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device that brings the power of Windows 10 to team collaboration. Learn how to plan, deploy, manage, and support your Surface Hub devices. url: https://docs.microsoft.com/surface-hub/index + # Card + - title: Surface Hub adoption guidance + summary: Get best practices for technical readiness to expedite Surface Hub adoption across your lines of business. + url: https://docs.microsoft.com/surface-hub/surface-hub-2s-adoption-kit + - title: Other resources # < 60 chars (optional) items: # Card @@ -47,8 +52,7 @@ additionalContent: url: https://docs.microsoft.com/learn/browse/?term=Surface - text: Microsoft Mechanics Surface videos url: https://www.youtube.com/watch?v=Uk2kJ5FUZxY&list=PLXtHYVsvn_b__1Baibdu4elN4SoF3JTBZ - - text: Surface Hub 2S adoption and training - url: https://docs.microsoft.com/surface-hub/surface-hub-2s-adoption-kit + # Card - title: Need help? links: From 9d4b2fb268400f5a50a183fd8d808a655ef67c5a Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 3 Apr 2020 11:04:01 -0700 Subject: [PATCH 13/33] Update index.yml --- devices/surface/index.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/index.yml b/devices/surface/index.yml index 76ed640229..cf28303fb0 100644 --- a/devices/surface/index.yml +++ b/devices/surface/index.yml @@ -29,7 +29,7 @@ additionalContent: url: https://docs.microsoft.com/en-us/surface/get-started # Card - title: Surface Hub documentation - summary: Learn how to deploy and manage Surface Hub 2S, the all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device that brings the power of Windows 10 to team collaboration. Learn how to plan, deploy, manage, and support your Surface Hub devices. + summary: Learn how to deploy and manage Surface Hub 2S, the all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device that brings the power of Windows 10 to team collaboration. url: https://docs.microsoft.com/surface-hub/index # Card - title: Surface Hub adoption guidance From 0b5a5e0d3bf80a4e46598703fdcdb7cdf8f9c7d6 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Fri, 3 Apr 2020 12:20:55 -0700 Subject: [PATCH 14/33] Update index.yml --- devices/surface/index.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/surface/index.yml b/devices/surface/index.yml index cf28303fb0..d9d7043dc2 100644 --- a/devices/surface/index.yml +++ b/devices/surface/index.yml @@ -29,11 +29,11 @@ additionalContent: url: https://docs.microsoft.com/en-us/surface/get-started # Card - title: Surface Hub documentation - summary: Learn how to deploy and manage Surface Hub 2S, the all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device that brings the power of Windows 10 to team collaboration. + summary: Learn how to deploy and manage Surface Hub 2S, the all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device. url: https://docs.microsoft.com/surface-hub/index # Card - title: Surface Hub adoption guidance - summary: Get best practices for technical readiness to expedite Surface Hub adoption across your lines of business. + summary: Get best practices for technical readiness and adoption across your lines of business. url: https://docs.microsoft.com/surface-hub/surface-hub-2s-adoption-kit - title: Other resources # < 60 chars (optional) From 8a1dd41754828fac573e4b2da113b30adfa21b41 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 3 Apr 2020 15:39:51 -0700 Subject: [PATCH 15/33] Replaced 61440 with xF000 --- windows/client-management/mdm/policy-csp-userrights.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index c485382b9e..25159c3271 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -53,17 +53,17 @@ Here are examples of data fields. The encoded 0xF000 is the standard delimiter/s - Grant an user right to multiple groups (Administrators, Authenticated Users) via SID ``` - *S-1-5-32-544*S-1-5-11 + *S-1-5-32-544*S-1-5-11 ``` - Grant an user right to multiple groups (Administrators, Authenticated Users) via a mix of SID and Strings ``` - *S-1-5-32-544Authenticated Users + *S-1-5-32-544Authenticated Users ``` - Grant an user right to multiple groups (Authenticated Users, Administrators) via strings ``` - Authenticated UsersAdministrators + Authenticated UsersAdministrators ``` - Empty input indicates that there are no users configured to have that user right From ca6709cafe7ef6163084d5a1b9f605be1cc3e554 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 3 Apr 2020 15:55:48 -0700 Subject: [PATCH 16/33] Change to content type, line break --- .../generate-kernel-or-complete-crash-dump.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/generate-kernel-or-complete-crash-dump.md b/windows/client-management/generate-kernel-or-complete-crash-dump.md index 3fa65253ea..6324135c56 100644 --- a/windows/client-management/generate-kernel-or-complete-crash-dump.md +++ b/windows/client-management/generate-kernel-or-complete-crash-dump.md @@ -61,7 +61,7 @@ If you can log on while the problem is occurring, you can use the Microsoft Sysi 2. Select **Start**, and then select **Command Prompt**. 3. At the command line, run the following command: - ```cmd + ```console notMyfault.exe /crash ``` @@ -80,6 +80,7 @@ To do this, follow these steps: > Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. 1. In Registry Editor, locate the following registry subkey: + **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl** 2. Right-click **CrashControl**, point to **New**, and then click **DWORD Value**. From 1958cfe72a51b9af2a532b48545e5ba5d62362d7 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 3 Apr 2020 15:57:25 -0700 Subject: [PATCH 17/33] Applied "> [!NOTE]" style --- windows/deployment/planning/windows-10-deprecated-features.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index 88dc39a125..5a34226e0f 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -21,7 +21,8 @@ The features described below are no longer being actively developed, and might b **The following list is subject to change and might not include every affected feature or functionality.** ->If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). +> [!NOTE] +> If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | From 3765a6e9097e57631fb2836f1261ea9b1c32a83e Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 3 Apr 2020 16:00:53 -0700 Subject: [PATCH 18/33] Corrected punctuation --- windows/deployment/planning/windows-10-removed-features.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/planning/windows-10-removed-features.md b/windows/deployment/planning/windows-10-removed-features.md index d2c548a158..5f0a73e50a 100644 --- a/windows/deployment/planning/windows-10-removed-features.md +++ b/windows/deployment/planning/windows-10-removed-features.md @@ -18,7 +18,7 @@ ms.topic: article Each version of Windows 10 adds new features and functionality; occasionally we also remove features and functionality, often because we've added a better option. Below are the details about the features and functionalities that we removed in Windows 10. **The list below is subject to change and might not include every affected feature or functionality.** -For information about features that might be removed in a future release, see [Windows 10 features we’re no longer developing](windows-10-deprecated-features.md) +For information about features that might be removed in a future release, see [Windows 10 features we’re no longer developing](windows-10-deprecated-features.md). > [!NOTE] > Join the [Windows Insider program](https://insider.windows.com) to get early access to new Windows 10 builds and test these changes yourself. @@ -50,7 +50,7 @@ The following features and functionalities have been removed from the installed |Reading List | Functionality to be integrated into Microsoft Edge. | 1709 | |Screen saver functionality in Themes | This functionality is disabled in Themes, and classified as **Removed** in this table. Screen saver functionality in Group Policies, Control Panel, and Sysprep continues to be functional. Lock screen features and policies are preferred. | 1709 | |Syskey.exe | Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). | 1709 | -|TCP Offload Engine | Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193).| 1709 | +|TCP Offload Engine | Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193)| 1709 | |Tile Data Layer |To be replaced by the Tile Store.| 1709 | |Resilient File System (ReFS) (added: August 17, 2017)| Creation ability will be available in the following editions only: Windows 10 Enterprise and Windows 10 Pro for Workstations. Creation ability will be removed from all other editions. All other editions will have Read and Write ability. | 1709 | |Apps Corner| This Windows 10 mobile application is removed in the version 1703 release. | 1703 | @@ -59,4 +59,4 @@ The following features and functionalities have been removed from the installed |Microsoft Paint | This application will not be available for languages that are not on the [full localization list](https://www.microsoft.com/windows/windows-10-specifications#Windows-10-localization). | 1703 | |NPN support in TLS | This feature is superseded by Application-Layer Protocol Negotiation (ALPN). | 1703 | |Windows Information Protection "AllowUserDecryption" policy | Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported. | 1703 | -|WSUS for Windows Mobile | Updates are being transitioned to the new Unified Update Platform (UUP) | 1703 | +|WSUS for Windows Mobile | Updates are being transitioned to the new Unified Update Platform (UUP). | 1703 | From 439e98c298790bde2cf352474602cdedac5d9d52 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 3 Apr 2020 16:02:11 -0700 Subject: [PATCH 19/33] Corrected punctuation --- .../hello-for-business/hello-hybrid-key-trust-devreg.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index af7baaf21a..314df80eac 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -37,7 +37,7 @@ You are ready to configure device registration for your hybrid environment. Hybr ## Configure Azure for Device Registration Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD. -To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-setup/) +To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-setup/). Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-manual) page. In the **Configuration steps** section, identify your configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a check mark. From 3fe73ac5c5474389d10ecfd4e4e010189801e299 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 3 Apr 2020 16:56:04 -0700 Subject: [PATCH 20/33] Edits --- .../microsoft-defender-atp/mac-install-with-jamf.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md index 5681d81f0e..2e8c52861f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md @@ -77,12 +77,12 @@ You need to create a configuration profile and a policy to start deploying Micro The configuration profile contains a custom settings payload that includes the following: - Microsoft Defender ATP for Mac onboarding information -- Approved Kernel Extensions payload, to enable running the Microsoft kernel driver +- Approved Kernel Extensions payload to enable running the Microsoft kernel driver To set the onboarding information, add a property list file that is named **jamf/WindowsDefenderATPOnboarding.plist** as a custom setting. To do this, select **Computers** > **Configuration Profiles** > **New**, and then select **Application & Custom Settings** > **Configure**. From there, you can upload the property list. >[!IMPORTANT] - > You have to set the **Preference Domain** to **com.microsoft.wdav.atp**. There have been a few changes to the Jamf Pro user interface in version 10.18 and later versions, and for the Custom Payloads. For more information about the changes, see [Configuration Profile Payload Settings Specific to Jamf Pro](https://www.jamf.com/jamf-nation/articles/217/configuration-profile-payload-settings-specific-to-jamf-pro). + > You have to set the **Preference Domain** to **com.microsoft.wdav.atp**. There are some changes to the Custom Payloads and also to the Jamf Pro user interface in version 10.18 and later versions. For more information about the changes, see [Configuration Profile Payload Settings Specific to Jamf Pro](https://www.jamf.com/jamf-nation/articles/217/configuration-profile-payload-settings-specific-to-jamf-pro). ![Configuration profile screenshot](./images/msdefender-mac-config-profile.png) From 9a33748c4fad173868eceda3968deef52bad7f39 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Mon, 6 Apr 2020 09:13:01 -0700 Subject: [PATCH 21/33] pencil edits --- .../surface-hub/manage-settings-with-mdm-for-surface-hub.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 0d30646f0b..93881711f2 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -217,15 +217,13 @@ The data type is also stated in the CSP documentation. The most common data type - bool (Boolean) - ## Example: Manage Surface Hub settings with Microsoft Intune You can use Microsoft Intune to manage Surface Hub settings. For custom settings, follow the instructions in [How to configure custom device settings in Microsoft Intune](https://docs.microsoft.com/intune/custom-settings-configure). For **Platform**, select **Windows 10 and later**, and in **Profile type**, select **Device restrictions (Windows 10 Team)**. - -## Example: Manage Surface Hub settings with Microsoft Endpoint Configuration Manager +## Example: Manage Surface Hub settings with Microsoft Endpoint Configuration Manager Configuration Manager supports managing modern devices that do not require the Configuration Manager client to manage them, including Surface Hub. If you already use Configuration Manager to manage other devices in your organization, you can continue to use the Configuration Manager console as your single location for managing Surface Hubs. > [!NOTE] From 5fc0a069cf61a9ee164bf649f7ff0b6ed09ed493 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 6 Apr 2020 09:54:59 -0700 Subject: [PATCH 22/33] update paragraph --- .../microsoft-defender-atp/configure-proxy-internet.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index 4654624800..66efa55144 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -102,7 +102,8 @@ See [Netsh Command Syntax, Contexts, and Formatting](https://docs.microsoft.com/ ## Enable access to Microsoft Defender ATP service URLs in the proxy server -If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are not blocked by default. Do not disable security monitoring or inspection of these URLs, but allow them as you would other internet traffic. They permit communication with Microsoft Defender ATP service in port 80 and 443: +If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, add the domains listed below to the allowed domains list. +If a proxy or firewall has HTTPS scanning (SSL inspection) enabled, exclude the domains listed below from HTTPS scanning. > [!NOTE] > settings-win.data.microsoft.com is only needed if you have Windows 10 machines running version 1803 or earlier.
From e9d2540033979d6649d2f4bbce9908e6efbde461 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 6 Apr 2020 10:06:54 -0700 Subject: [PATCH 23/33] Update live-response.md --- .../microsoft-defender-atp/live-response.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 80231ef03d..badd3961c2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -39,7 +39,14 @@ With live response, analysts will have the ability to: ## Before you begin Before you can initiate a session on a machine, make sure you fulfill the following requirements: -- Machines must be Windows 10, version 18323 (also known as Windows 10 19H1) or later. +- **Verify that you're running a supported version of Windows 10**
+Machines must be Windows 10, version 18323 (also known as Windows 10 19H1) or later. + +- **Make sure to install appropriate security updates**
+ - 1809 (RS5): [KB4537818](https://support.microsoft.com/help/4537818/windows-10-update-kb4537818) + - 1803 (RS4): [KB4537795](https://support.microsoft.com/help/4537795/windows-10-update-kb4537795) + - 1709 (RS3): [KB4537816](https://support.microsoft.com/help/4537816/windows-10-update-kb4537816) + - **Enable live response from the settings page**
You'll need to enable the live response capability in the [Advanced features settings](advanced-features.md) page. @@ -55,7 +62,7 @@ You'll need to enable the live response capability in the [Advanced features set Running unsigned scripts is generally not recommended as it can increase your exposure to threats. If you must use them however, you'll need to enable the setting in the [Advanced features settings](advanced-features.md) page. - **Ensure that you have the appropriate permissions**
- Only users who have been provisioned with the appropriate permissions can initiate a session. For more information on role assignments see, [Create and manage roles](user-roles.md). + Only users who have been provisioned with the appropriate permissions can initiate a session. For more information on role assignments see, [Create and manage roles](user-roles.md). > [!IMPORTANT] > The option to upload a file to the library is only available to those with the appropriate RBAC permissions. The button is greyed out for users with only delegated permissions. From 587e6a46cdd28b049458d1ff2f85d4c167ef39f4 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 6 Apr 2020 10:09:02 -0700 Subject: [PATCH 24/33] Update live-response.md --- .../microsoft-defender-atp/live-response.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index badd3961c2..f26999eaef 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -47,7 +47,6 @@ Machines must be Windows 10, version 18323 (also known as Windows 10 19H1) or la - 1803 (RS4): [KB4537795](https://support.microsoft.com/help/4537795/windows-10-update-kb4537795) - 1709 (RS3): [KB4537816](https://support.microsoft.com/help/4537816/windows-10-update-kb4537816) - - **Enable live response from the settings page**
You'll need to enable the live response capability in the [Advanced features settings](advanced-features.md) page. @@ -95,12 +94,16 @@ The dashboard also gives you access to: 3. Use the built-in commands to do investigative work. For more information see, [Live response commands](#live-response-commands). 4. After completing your investigation, select **Disconnect session**, then select **Confirm**. +## Download a file in the background + ## Live response commands + Depending on the role that's been granted to you, you can run basic or advanced live response commands. User permissions are controlled by RBAC custom roles. For more information on role assignments see, [Create and manage roles](user-roles.md). ### Basic commands + The following commands are available for user roles that's been granted the ability to run **basic** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md). Command | Description @@ -137,11 +140,13 @@ undo | Restores an entity that was remediated. ## Use live response commands + The commands that you can use in the console follow similar principles as [Windows Commands](https://docs.microsoft.com/windows-server/administration/windows-commands/windows-commands#BKMK_c). The advanced commands offer a more robust set of actions that allow you to take more powerful actions such as download and upload a file, run scripts on the machine, and take remediation actions on an entity. ### Get a file from the machine + For scenarios when you'd like get a file from a machine you're investigating, you can use the `getfile` command. This allows you to save the file from the machine for further investigation. >[!NOTE] @@ -154,7 +159,8 @@ Live response allows PowerShell scripts to run, however you must first put the f You can have a collection of PowerShell scripts that can run on machines that you initiate live response sessions with. -**To upload a file in the library:** +#### To upload a file in the library + 1. Click **Upload file to library**. 2. Click **Browse** and select the file. 3. Provide a brief description. @@ -252,7 +258,7 @@ Each command is tracked with full details such as: - A machine can only be in one session at a time - There is a file size limit of 750mb when downloading files from a machine -## Related topic +## Related article - [Live response command examples](live-response-command-examples.md) From 2c4c946de82b96a00ef40892fbdf096763a25fb8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 6 Apr 2020 10:12:34 -0700 Subject: [PATCH 25/33] Update live-response.md --- .../microsoft-defender-atp/live-response.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index f26999eaef..4628684a6f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -94,17 +94,13 @@ The dashboard also gives you access to: 3. Use the built-in commands to do investigative work. For more information see, [Live response commands](#live-response-commands). 4. After completing your investigation, select **Disconnect session**, then select **Confirm**. -## Download a file in the background - - - ## Live response commands Depending on the role that's been granted to you, you can run basic or advanced live response commands. User permissions are controlled by RBAC custom roles. For more information on role assignments see, [Create and manage roles](user-roles.md). ### Basic commands -The following commands are available for user roles that's been granted the ability to run **basic** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md). +The following commands are available for user roles that are granted the ability to run **basic** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md). Command | Description :---|:---|:--- @@ -124,9 +120,8 @@ scheduledtasks| Shows all scheduled tasks on the machine. services | Shows all services on the machine. trace | Sets the terminal's logging mode to debug. - ### Advanced commands -The following commands are available for user roles that's been granted the ability to run **advanced** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md). +The following commands are available for user roles that are granted the ability to run **advanced** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md). Command | Description :---|:--- @@ -152,6 +147,14 @@ For scenarios when you'd like get a file from a machine you're investigating, yo >[!NOTE] >There is a file size limit of 750mb. +### Download a file in the background + +To enable your security operations team to continue investigating an impacted device, files can now be downloaded in the background. + +#### To download a file in the background + +1. + ### Put a file in the library Live response has a library where you can put files into. The library stores files (such as scripts) that can be run in a live response session at the tenant level. From 024183358c132a0a75b49286f398d8483c358aad Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Mon, 6 Apr 2020 10:13:27 -0700 Subject: [PATCH 26/33] pencil edits --- ...anage-settings-with-mdm-for-surface-hub.md | 92 +++++++++---------- 1 file changed, 46 insertions(+), 46 deletions(-) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 93881711f2..3a3d709db8 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -65,25 +65,25 @@ For more information, see [SurfaceHub configuration service provider](https://ms | Maintenance hours | MaintenanceHoursSimple/Hours/StartTime
MaintenanceHoursSimple/Hours/Duration | Yes | Yes | Yes | | Automatically turn on the screen using motion sensors | InBoxApps/Welcome/AutoWakeScreen | Yes | Yes | Yes | | Require a pin for wireless projection | InBoxApps/WirelessProjection/PINRequired | Yes | Yes | Yes | -| Enable wireless projection | InBoxApps/WirelessProjection/Enabled | Yes | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Miracast channel to use for wireless projection | InBoxApps/WirelessProjection/Channel | Yes | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Connect to your Operations Management Suite workspace | MOMAgent/WorkspaceID
MOMAgent/WorkspaceKey | Yes | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Welcome screen background image | InBoxApps/Welcome/CurrentBackgroundPath | Yes | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Meeting information displayed on the welcome screen | InBoxApps/Welcome/MeetingInfoOption | Yes | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Friendly name for wireless projection | Properties/FriendlyName | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Enable wireless projection | InBoxApps/WirelessProjection/Enabled | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Miracast channel to use for wireless projection | InBoxApps/WirelessProjection/Channel | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Connect to your Operations Management Suite workspace | MOMAgent/WorkspaceID
MOMAgent/WorkspaceKey | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Welcome screen background image | InBoxApps/Welcome/CurrentBackgroundPath | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Meeting information displayed on the welcome screen | InBoxApps/Welcome/MeetingInfoOption | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager | Yes | +| Friendly name for wireless projection | Properties/FriendlyName | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | | Device account, including password rotation | DeviceAccount/*``*
See [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). | No | No | Yes | -| Specify Skype domain | InBoxApps/SkypeForBusiness/DomainName | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Auto launch Connect App when projection is initiated | InBoxApps/Connect/AutoLaunch | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Set default volume | Properties/DefaultVolume | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Set screen timeout | Properties/ScreenTimeout | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Set session timeout | Properties/SessionTimeout | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Set sleep timeout | Properties/SleepTimeout | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow session to resume after screen is idle | Properties/AllowSessionResume | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow device account to be used for proxy authentication | Properties/AllowAutoProxyAuth | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable auto-populating the sign-in dialog with invitees from scheduled meetings | Properties/DisableSignInSuggestions | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable "My meetings and files" feature in Start menu | Properties/DoNotShowMyMeetingsAndFiles | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Set the LanProfile for 802.1x Wired Auth | Dot3/LanProfile | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Set the EapUserData for 802.1x Wired Auth | Dot3/EapUserData | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Specify Skype domain | InBoxApps/SkypeForBusiness/DomainName | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Auto launch Connect App when projection is initiated | InBoxApps/Connect/AutoLaunch | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Set default volume | Properties/DefaultVolume | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Set screen timeout | Properties/ScreenTimeout | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Set session timeout | Properties/SessionTimeout | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Set sleep timeout | Properties/SleepTimeout | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow session to resume after screen is idle | Properties/AllowSessionResume | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow device account to be used for proxy authentication | Properties/AllowAutoProxyAuth | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Disable auto-populating the sign-in dialog with invitees from scheduled meetings | Properties/DisableSignInSuggestions | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Disable "My meetings and files" feature in Start menu | Properties/DoNotShowMyMeetingsAndFiles | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Set the LanProfile for 802.1x Wired Auth | Dot3/LanProfile | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Set the EapUserData for 802.1x Wired Auth | Dot3/EapUserData | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. @@ -97,12 +97,12 @@ The following tables include info on Windows 10 settings that have been validate | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | |--------------------|------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Allow Bluetooth | Keep this enabled to support Bluetooth peripherals. | [Connectivity/AllowBluetooth](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Connectivity_AllowBluetooth) | Yes.
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Bluetooth policies | Use to set the Bluetooth device name, and block advertising, discovery, and automatic pairing. | Bluetooth/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes.
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow camera | Keep this enabled for Skype for Business. | [Camera/AllowCamera](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Camera_AllowCamera) | Yes.
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow location | Keep this enabled to support apps such as Maps. | [System/AllowLocation](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowLocation) | Yes.
. | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow telemetry | Keep this enabled to help Microsoft improve Surface Hub. | [System/AllowTelemetry](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowTelemetry) | Yes.
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow USB Drives | Keep this enabled to support USB drives on Surface Hub | [System/AllowStorageCard](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowstoragecard) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Allow Bluetooth | Keep this enabled to support Bluetooth peripherals. | [Connectivity/AllowBluetooth](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Connectivity_AllowBluetooth) | Yes.
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Bluetooth policies | Use to set the Bluetooth device name, and block advertising, discovery, and automatic pairing. | Bluetooth/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes.
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow camera | Keep this enabled for Skype for Business. | [Camera/AllowCamera](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Camera_AllowCamera) | Yes.
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow location | Keep this enabled to support apps such as Maps. | [System/AllowLocation](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowLocation) | Yes.
. | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow telemetry | Keep this enabled to help Microsoft improve Surface Hub. | [System/AllowTelemetry](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowTelemetry) | Yes.
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow USB Drives | Keep this enabled to support USB drives on Surface Hub | [System/AllowStorageCard](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowstoragecard) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. @@ -110,15 +110,15 @@ The following tables include info on Windows 10 settings that have been validate | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | |-----------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Homepages | Use to configure the default homepages in Microsoft Edge. | [Browser/Homepages](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_Homepages) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow cookies | Surface Hub automatically deletes cookies at the end of a session. Use this to block cookies within a session. | [Browser/AllowCookies](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowCookies) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow developer tools | Use to stop users from using F12 Developer Tools. | [Browser/AllowDeveloperTools](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDeveloperTools) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow Do Not Track | Use to enable Do Not Track headers. | [Browser/AllowDoNotTrack](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDoNotTrack) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow pop-ups | Use to block pop-up browser windows. | [Browser/AllowPopups](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowPopups) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow search suggestions | Use to block search suggestions in the address bar. | [Browser/AllowSearchSuggestionsinAddressBar](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSearchSuggestionsinAddressBar) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow Windows Defender SmartScreen | Keep this enabled to turn on Windows Defender SmartScreen. | [Browser/AllowSmartScreen](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Prevent ignoring Windows Defender SmartScreen warnings for websites | For extra security, use to stop users from ignoring Windows Defender SmartScreen warnings and block them from accessing potentially malicious websites. | [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Prevent ignoring Windows Defender SmartScreen warnings for files | For extra security, use to stop users from ignoring Windows Defender SmartScreen warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Homepages | Use to configure the default homepages in Microsoft Edge. | [Browser/Homepages](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_Homepages) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow cookies | Surface Hub automatically deletes cookies at the end of a session. Use this to block cookies within a session. | [Browser/AllowCookies](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowCookies) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow developer tools | Use to stop users from using F12 Developer Tools. | [Browser/AllowDeveloperTools](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDeveloperTools) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow Do Not Track | Use to enable Do Not Track headers. | [Browser/AllowDoNotTrack](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDoNotTrack) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow pop-ups | Use to block pop-up browser windows. | [Browser/AllowPopups](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowPopups) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow search suggestions | Use to block search suggestions in the address bar. | [Browser/AllowSearchSuggestionsinAddressBar](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSearchSuggestionsinAddressBar) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Allow Windows Defender SmartScreen | Keep this enabled to turn on Windows Defender SmartScreen. | [Browser/AllowSmartScreen](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Prevent ignoring Windows Defender SmartScreen warnings for websites | For extra security, use to stop users from ignoring Windows Defender SmartScreen warnings and block them from accessing potentially malicious websites. | [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Prevent ignoring Windows Defender SmartScreen warnings for files | For extra security, use to stop users from ignoring Windows Defender SmartScreen warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. @@ -126,13 +126,13 @@ The following tables include info on Windows 10 settings that have been validate | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | |---------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Use Current Branch or Current Branch for Business | Use to configure Windows Update for Business – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/BranchReadinessLevel](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Defer feature updates | See above. | [Update/ DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Defer quality updates | See above. | [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Pause feature updates | See above. | [Update/PauseFeatureUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Pause quality updates | See above. | [Update/PauseQualityUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Configure device to use WSUS | Use to connect your Surface Hub to WSUS instead of Windows Update – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Delivery optimization | Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Configure Delivery Optimization for Windows 10](https://technet.microsoft.com/itpro/windows/manage/waas-delivery-optimization) for details. | DeliveryOptimization/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Use Current Branch or Current Branch for Business | Use to configure Windows Update for Business – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/BranchReadinessLevel](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Defer feature updates | See above. | [Update/ DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Defer quality updates | See above. | [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Pause feature updates | See above. | [Update/PauseFeatureUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Pause quality updates | See above. | [Update/PauseQualityUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Configure device to use WSUS | Use to connect your Surface Hub to WSUS instead of Windows Update – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Delivery optimization | Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Configure Delivery Optimization for Windows 10](https://technet.microsoft.com/itpro/windows/manage/waas-delivery-optimization) for details. | DeliveryOptimization/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. @@ -140,7 +140,7 @@ The following tables include info on Windows 10 settings that have been validate | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | |-------------------|----------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Defender policies | Use to configure various Defender settings, including a scheduled scan time. | Defender/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Defender policies | Use to configure various Defender settings, including a scheduled scan time. | Defender/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | | Defender status | Use to initiate a Defender scan, force a Security intelligence update, query any threats detected. | [Defender CSP](https://msdn.microsoft.com/library/windows/hardware/mt187856.aspx) | Yes | Yes | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. @@ -150,8 +150,8 @@ The following tables include info on Windows 10 settings that have been validate | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | |------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| | Reboot the device immediately | Use in conjunction with OMS to minimize support costs – see [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). | ./Vendor/MSFT/Reboot/RebootNow
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes | No | Yes | -| Reboot the device at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/Single
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Reboot the device daily at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/DailyRecurrent
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Reboot the device at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/Single
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Reboot the device daily at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/DailyRecurrent
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. @@ -180,7 +180,7 @@ The following tables include info on Windows 10 settings that have been validate | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | |------------------------|--------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Set Network QoS Policy | Use to set a QoS policy to perform a set of actions on network traffic. This is useful for prioritizing Skype network packets. | [NetworkQoSPolicy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkqospolicy-csp) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Set Network QoS Policy | Use to set a QoS policy to perform a set of actions on network traffic. This is useful for prioritizing Skype network packets. | [NetworkQoSPolicy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkqospolicy-csp) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. @@ -188,7 +188,7 @@ The following tables include info on Windows 10 settings that have been validate | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | |-------------------|---------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Set Network proxy | Use to configure a proxy server for ethernet and Wi-Fi connections. | [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Set Network proxy | Use to configure a proxy server for ethernet and Wi-Fi connections. | [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. @@ -196,7 +196,7 @@ The following tables include info on Windows 10 settings that have been validate | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | |----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Configure Start menu | Use to configure which apps are displayed on the Start menu. For more information, see [Configure Surface Hub Start menu](surface-hub-start-menu.md) | [Policy CSP: Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Configure Start menu | Use to configure which apps are displayed on the Start menu. For more information, see [Configure Surface Hub Start menu](surface-hub-start-menu.md) | [Policy CSP: Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. From 6d53951fd018cd676cb8f54b0a8cd7f8cf403397 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 6 Apr 2020 10:23:07 -0700 Subject: [PATCH 27/33] Update live-response.md --- .../microsoft-defender-atp/live-response.md | 51 ++++++++++++------- 1 file changed, 33 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 4628684a6f..5e9ac1ea35 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -85,14 +85,17 @@ The dashboard also gives you access to: ## Initiate a live response session on a machine 1. Log in to Microsoft Defender Security Center. + 2. Navigate to the machines list page and select a machine to investigate. The machine page opens. >[!NOTE] >Machines must be on Windows 10, version 18323 (also known as Windows 10 19H1) or later. -2. Launch the live response session by selecting **Initiate live response session**. A command console is displayed. Wait while the session connects to the machine. -3. Use the built-in commands to do investigative work. For more information see, [Live response commands](#live-response-commands). -4. After completing your investigation, select **Disconnect session**, then select **Confirm**. +3. Launch the live response session by selecting **Initiate live response session**. A command console is displayed. Wait while the session connects to the machine. + +4. Use the built-in commands to do investigative work. For more information see, [Live response commands](#live-response-commands). + +5. After completing your investigation, select **Disconnect session**, then select **Confirm**. ## Live response commands @@ -109,7 +112,9 @@ cls | Clears the console screen. connect | Initiates a live response session to the machine. connections | Shows all the active connections. dir | Shows a list of files and subdirectories in a directory +`download &` | Downloads a file in the background drivers | Shows all drivers installed on the machine. +`fg ` | Returns a file download to the foreground fileinfo | Get information about a file. findfile | Locates files by a given name on the machine. help | Provides help information for live response commands. @@ -151,11 +156,21 @@ For scenarios when you'd like get a file from a machine you're investigating, yo To enable your security operations team to continue investigating an impacted device, files can now be downloaded in the background. -#### To download a file in the background +- To download a file in the background, in the live response command console, type `download &` +- If you are waiting for a file to be downloaded, you can move it to the background by using Ctrl + Z. +- To bring a file download to the foreground, in the live response command console, type `fg ` + +Here are some examples: + + +|Command |What it does | +|---------|---------| +|`"C:\windows\some_file.exe" &` |Starts downloading a file named *some_file.exe* in the background. | +|`fg 1234` |Returns a download with command ID *1234* to the foreground | -1. ### Put a file in the library + Live response has a library where you can put files into. The library stores files (such as scripts) that can be run in a live response session at the tenant level. Live response allows PowerShell scripts to run, however you must first put the files into the library before you can run them. @@ -165,11 +180,17 @@ You can have a collection of PowerShell scripts that can run on machines that yo #### To upload a file in the library 1. Click **Upload file to library**. + 2. Click **Browse** and select the file. + 3. Provide a brief description. + 4. Specify if you'd like to overwrite a file with the same name. + 5. If you'd like to be know what parameters are needed for the script, select the script parameters check box. In the text field, enter an example and a description. + 6. Click **Confirm**. + 7. (Optional) To verify that the file was uploaded to the library, run the `library` command. @@ -179,9 +200,8 @@ Anytime during a session, you can cancel a command by pressing CTRL + C. >[!WARNING] >Using this shortcut will not stop the command in the agent side. It will only cancel the command in the portal. So, changing operations such as "remediate" may continue, while the command is canceled. - - ### Automatically run prerequisite commands + Some commands have prerequisite commands to run. If you don't run the prerequisite command, you'll get an error. For example, running the `download` command without `fileinfo` will return an error. You can use the auto flag to automatically run prerequisite commands, for example: @@ -190,8 +210,8 @@ You can use the auto flag to automatically run prerequisite commands, for exampl getfile c:\Users\user\Desktop\work.txt -auto ``` - ## Run a PowerShell script + Before you can run a PowerShell script, you must first upload it to the library. After uploading the script to the library, use the `run` command to run the script. @@ -201,9 +221,8 @@ If you plan to use an unsigned script in the session, you'll need to enable the >[!WARNING] >Allowing the use of unsigned scripts may increase your exposure to threats. - - ## Apply command parameters + - View the console help to learn about command parameters. To learn about an individual command, run: `help ` @@ -220,9 +239,8 @@ If you plan to use an unsigned script in the session, you'll need to enable the ` -type file -id - auto` or `remediate file - auto`. - - ## Supported output types + Live response supports table and JSON format output types. For each command, there's a default output behavior. You can modify the output in your preferred output format using the following commands: - `-output json` @@ -231,8 +249,8 @@ Live response supports table and JSON format output types. For each command, the >[!NOTE] >Fewer fields are shown in table format due to the limited space. To see more details in the output, you can use the JSON output command so that more details are shown. - ## Supported output pipes + Live response supports output piping to CLI and file. CLI is the default output behavior. You can pipe the output to a file using the following command: [command] > [filename].txt. Example: @@ -241,9 +259,8 @@ Example: processes > output.txt ``` - - ## View the command log + Select the **Command log** tab to see the commands used on the machine during a session. Each command is tracked with full details such as: - ID @@ -251,10 +268,8 @@ Each command is tracked with full details such as: - Duration - Status and input or output side bar - - - ## Limitations + - Live response sessions are limited to 10 live response sessions at a time - Large scale command execution is not supported - A user can only initiate one session at a time From bea83e86509fc5166f71ac06005beefa440430d6 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Mon, 6 Apr 2020 10:26:38 -0700 Subject: [PATCH 28/33] pencil edit --- .../surface-hub/manage-settings-with-mdm-for-surface-hub.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 3a3d709db8..5394d7c761 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -70,7 +70,7 @@ For more information, see [SurfaceHub configuration service provider](https://ms | Connect to your Operations Management Suite workspace | MOMAgent/WorkspaceID
MOMAgent/WorkspaceKey | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | | Welcome screen background image | InBoxApps/Welcome/CurrentBackgroundPath | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | | Meeting information displayed on the welcome screen | InBoxApps/Welcome/MeetingInfoOption | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager | Yes | -| Friendly name for wireless projection | Properties/FriendlyName | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Friendly name for wireless projection | Properties/FriendlyName | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | | Device account, including password rotation | DeviceAccount/*``*
See [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). | No | No | Yes | | Specify Skype domain | InBoxApps/SkypeForBusiness/DomainName | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | | Auto launch Connect App when projection is initiated | InBoxApps/Connect/AutoLaunch | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | @@ -82,8 +82,8 @@ For more information, see [SurfaceHub configuration service provider](https://ms | Allow device account to be used for proxy authentication | Properties/AllowAutoProxyAuth | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | | Disable auto-populating the sign-in dialog with invitees from scheduled meetings | Properties/DisableSignInSuggestions | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | | Disable "My meetings and files" feature in Start menu | Properties/DoNotShowMyMeetingsAndFiles | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Set the LanProfile for 802.1x Wired Auth | Dot3/LanProfile | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Set the EapUserData for 802.1x Wired Auth | Dot3/EapUserData | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Set the LanProfile for 802.1x Wired Auth | Dot3/LanProfile | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | +| Set the EapUserData for 802.1x Wired Auth | Dot3/EapUserData | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. From 3f19a7716b0011dc964e75a4f5fc51ee512c885f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 6 Apr 2020 10:30:25 -0700 Subject: [PATCH 29/33] Update live-response.md --- .../microsoft-defender-atp/live-response.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 5e9ac1ea35..009b72af60 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -27,7 +27,7 @@ Live response is a capability that gives you instantaneous access to a machine u Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats. -> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUW] +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4qLUW] With live response, analysts will have the ability to: - Run basic and advanced commands to do investigative work @@ -40,7 +40,12 @@ With live response, analysts will have the ability to: Before you can initiate a session on a machine, make sure you fulfill the following requirements: - **Verify that you're running a supported version of Windows 10**
-Machines must be Windows 10, version 18323 (also known as Windows 10 19H1) or later. +Machines must be running one of the following versions of Windows 10: + - [1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) + - [1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) + - [1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) + - [1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) + - [1909](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1909) or later - **Make sure to install appropriate security updates**
- 1809 (RS5): [KB4537818](https://support.microsoft.com/help/4537818/windows-10-update-kb4537818) From a1eee7256bfc568cd55ca3bf5d8acbeb3d86c374 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 6 Apr 2020 10:37:44 -0700 Subject: [PATCH 30/33] Update live-response.md --- .../microsoft-defender-atp/live-response.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 009b72af60..f6e60e037a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -1,6 +1,6 @@ --- title: Investigate entities on machines using live response in Microsoft Defender ATP -description: Access a machine using a secure remote shell connection to do investigative work and take immediate response actions on a machine in real-time. +description: Access a machine using a secure remote shell connection to do investigative work and take immediate response actions on a machine in real time. keywords: remote, shell, connection, live, response, real-time, command, script, remediate, hunt, export, log, drop, download, file, search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -23,21 +23,22 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Live response is a capability that gives you instantaneous access to a machine using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats – real-time. +Live response is a capability that gives your security operations team instantaneous access to a device (also referred to as a machine) using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats –- in real time. -Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats. +Live response is designed to enhance investigations by enabling your security operations team to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats. > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4qLUW] -With live response, analysts will have the ability to: -- Run basic and advanced commands to do investigative work +With live response, analysts can do all of the following tasks: +- Run basic and advanced commands to do investigative work on a device - Download files such as malware samples and outcomes of PowerShell scripts -- Upload a PowerShell script or executable to the library and run it on the machine from a tenant level +- Download files in the background (new!) +- Upload a PowerShell script or executable to the library and run it on a device from a tenant level - Take or undo remediation actions - ## Before you begin -Before you can initiate a session on a machine, make sure you fulfill the following requirements: + +Before you can initiate a session on a device, make sure you fulfill the following requirements: - **Verify that you're running a supported version of Windows 10**
Machines must be running one of the following versions of Windows 10: From 81d0f79c09e54080d26345b30113e24a3955018f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 6 Apr 2020 10:42:27 -0700 Subject: [PATCH 31/33] Update live-response.md --- .../microsoft-defender-atp/live-response.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index f6e60e037a..bd90650d53 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -41,14 +41,15 @@ With live response, analysts can do all of the following tasks: Before you can initiate a session on a device, make sure you fulfill the following requirements: - **Verify that you're running a supported version of Windows 10**
-Machines must be running one of the following versions of Windows 10: - - [1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) - - [1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) - - [1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) - - [1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) +Devices must be running one of the following versions of Windows 10: - [1909](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1909) or later + - [1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) + - [1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) + - [1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) + - [1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) - **Make sure to install appropriate security updates**
+ - 1903: [KB4515384](https://support.microsoft.com/help/4515384/windows-10-update-kb4515384) - 1809 (RS5): [KB4537818](https://support.microsoft.com/help/4537818/windows-10-update-kb4537818) - 1803 (RS4): [KB4537795](https://support.microsoft.com/help/4537795/windows-10-update-kb4537795) - 1709 (RS3): [KB4537816](https://support.microsoft.com/help/4537816/windows-10-update-kb4537816) From 590bf6746fc2dcd1d0358ed6b3ff82d686134f8e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 6 Apr 2020 10:50:06 -0700 Subject: [PATCH 32/33] Update live-response.md --- .../microsoft-defender-atp/live-response.md | 83 +++++++++---------- 1 file changed, 40 insertions(+), 43 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index bd90650d53..f6dd320bfc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Investigate entities on machines using live response +# Investigate entities on devices using live response **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -65,18 +65,18 @@ You'll need to enable the live response capability in the [Advanced features set >[!WARNING] >Allowing the use of unsigned scripts may increase your exposure to threats. - Running unsigned scripts is generally not recommended as it can increase your exposure to threats. If you must use them however, you'll need to enable the setting in the [Advanced features settings](advanced-features.md) page. + Running unsigned scripts is not recommended as it can increase your exposure to threats. If you must use them however, you'll need to enable the setting in the [Advanced features settings](advanced-features.md) page. - **Ensure that you have the appropriate permissions**
- Only users who have been provisioned with the appropriate permissions can initiate a session. For more information on role assignments see, [Create and manage roles](user-roles.md). + Only users who have been provisioned with the appropriate permissions can initiate a session. For more information on role assignments, see [Create and manage roles](user-roles.md). > [!IMPORTANT] > The option to upload a file to the library is only available to those with the appropriate RBAC permissions. The button is greyed out for users with only delegated permissions. - Depending on the role that's been granted to you, you can run basic or advanced live response commands. Users permission are controlled by RBAC custom role. + Depending on the role that's been granted to you, you can run basic or advanced live response commands. Users permissions are controlled by RBAC custom role. ## Live response dashboard overview -When you initiate a live response session on a machine, a dashboard opens. The dashboard provides information about the session such as: +When you initiate a live response session on a device, a dashboard opens. The dashboard provides information about the session such as the following: - Who created the session - When the session started @@ -93,68 +93,65 @@ The dashboard also gives you access to: 1. Log in to Microsoft Defender Security Center. -2. Navigate to the machines list page and select a machine to investigate. The machine page opens. +2. Navigate to the devices list page and select a machine to investigate. The machines page opens. - >[!NOTE] - >Machines must be on Windows 10, version 18323 (also known as Windows 10 19H1) or later. +3. Launch the live response session by selecting **Initiate live response session**. A command console is displayed. Wait while the session connects to the device. -3. Launch the live response session by selecting **Initiate live response session**. A command console is displayed. Wait while the session connects to the machine. - -4. Use the built-in commands to do investigative work. For more information see, [Live response commands](#live-response-commands). +4. Use the built-in commands to do investigative work. For more information, see [Live response commands](#live-response-commands). 5. After completing your investigation, select **Disconnect session**, then select **Confirm**. ## Live response commands -Depending on the role that's been granted to you, you can run basic or advanced live response commands. User permissions are controlled by RBAC custom roles. For more information on role assignments see, [Create and manage roles](user-roles.md). +Depending on the role that's been granted to you, you can run basic or advanced live response commands. User permissions are controlled by RBAC custom roles. For more information on role assignments, see [Create and manage roles](user-roles.md). ### Basic commands -The following commands are available for user roles that are granted the ability to run **basic** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md). +The following commands are available for user roles that are granted the ability to run **basic** live response commands. For more information on role assignments, see [Create and manage roles](user-roles.md). Command | Description :---|:---|:--- -cd | Changes the current directory. -cls | Clears the console screen. -connect | Initiates a live response session to the machine. -connections | Shows all the active connections. -dir | Shows a list of files and subdirectories in a directory +`cd` | Changes the current directory. +`cls` | Clears the console screen. +`connect` | Initiates a live response session to the device. +`connections` | Shows all the active connections. +`dir` | Shows a list of files and subdirectories in a directory `download &` | Downloads a file in the background -drivers | Shows all drivers installed on the machine. +drivers | Shows all drivers installed on the device. `fg ` | Returns a file download to the foreground -fileinfo | Get information about a file. -findfile | Locates files by a given name on the machine. -help | Provides help information for live response commands. -persistence | Shows all known persistence methods on the machine. -processes | Shows all processes running on the machine. -registry | Shows registry values. -scheduledtasks| Shows all scheduled tasks on the machine. -services | Shows all services on the machine. -trace | Sets the terminal's logging mode to debug. +`fileinfo` | Get information about a file. +`findfile` | Locates files by a given name on the device. +`help` | Provides help information for live response commands. +`persistence` | Shows all known persistence methods on the device. +`processes` | Shows all processes running on the device. +`registry` | Shows registry values. +`scheduledtasks` | Shows all scheduled tasks on the device. +`services` | Shows all services on the device. +`trace` | Sets the terminal's logging mode to debug. ### Advanced commands The following commands are available for user roles that are granted the ability to run **advanced** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md). -Command | Description -:---|:--- -analyze | Analyses the entity with various incrimination engines to reach a verdict. -getfile | Gets a file from the machine.
NOTE: This command has a prerequisite command. You can use the `-auto` command in conjunction with `getfile` to automatically run the prerequisite command. -run | Runs a PowerShell script from the library on the machine. -library | Lists files that were uploaded to the live response library. -putfile | Puts a file from the library to the machine. Files are saved in a working folder and are deleted when the machine restarts by default. -remediate | Remediates an entity on the machine. The remediation action will vary depending on the entity type:
- File: delete
- Process: stop, delete image file
- Service: stop, delete image file
- Registry entry: delete
- Scheduled task: remove
- Startup folder item: delete file
NOTE: This command has a prerequisite command. You can use the `-auto` command in conjunction with `remediate` to automatically run the prerequisite command. -undo | Restores an entity that was remediated. +| Command | Description | +|---|---| +| `analyze` | Analyses the entity with various incrimination engines to reach a verdict. | +| `getfile` | Gets a file from the device.
NOTE: This command has a prerequisite command. You can use the `-auto` command in conjunction with `getfile` to automatically run the prerequisite command. | +| `run` | Runs a PowerShell script from the library on the device. | +| `library` | Lists files that were uploaded to the live response library. | +| `putfile` | Puts a file from the library to the device. Files are saved in a working folder and are deleted when the device restarts by default. | +| `remediate` | Remediates an entity on the device. The remediation action will vary depending on the entity type:
- File: delete
- Process: stop, delete image file
- Service: stop, delete image file
- Registry entry: delete
- Scheduled task: remove
- Startup folder item: delete file
NOTE: This command has a prerequisite command. You can use the `-auto` command in conjunction with `remediate` to automatically run the prerequisite command. +|`undo` | Restores an entity that was remediated. | ## Use live response commands The commands that you can use in the console follow similar principles as [Windows Commands](https://docs.microsoft.com/windows-server/administration/windows-commands/windows-commands#BKMK_c). -The advanced commands offer a more robust set of actions that allow you to take more powerful actions such as download and upload a file, run scripts on the machine, and take remediation actions on an entity. +The advanced commands offer a more robust set of actions that allow you to take more powerful actions such as download and upload a file, run scripts on the device, and take remediation actions on an entity. ### Get a file from the machine -For scenarios when you'd like get a file from a machine you're investigating, you can use the `getfile` command. This allows you to save the file from the machine for further investigation. +For scenarios when you'd like get a file from a device you're investigating, you can use the `getfile` command. This allows you to save the file from the device for further investigation. >[!NOTE] >There is a file size limit of 750mb. @@ -182,7 +179,7 @@ Live response has a library where you can put files into. The library stores fil Live response allows PowerShell scripts to run, however you must first put the files into the library before you can run them. -You can have a collection of PowerShell scripts that can run on machines that you initiate live response sessions with. +You can have a collection of PowerShell scripts that can run on devices that you initiate live response sessions with. #### To upload a file in the library @@ -268,7 +265,7 @@ processes > output.txt ## View the command log -Select the **Command log** tab to see the commands used on the machine during a session. +Select the **Command log** tab to see the commands used on the device during a session. Each command is tracked with full details such as: - ID - Command line @@ -280,8 +277,8 @@ Each command is tracked with full details such as: - Live response sessions are limited to 10 live response sessions at a time - Large scale command execution is not supported - A user can only initiate one session at a time -- A machine can only be in one session at a time -- There is a file size limit of 750mb when downloading files from a machine +- A device can only be in one session at a time +- There is a file size limit of 750mb when downloading files from a device ## Related article - [Live response command examples](live-response-command-examples.md) From 035469b791fc2c03bbc21ec3f7ca382db946d170 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 6 Apr 2020 11:02:12 -0700 Subject: [PATCH 33/33] Update live-response.md --- .../microsoft-defender-atp/live-response.md | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index f6dd320bfc..aa9058cedb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -109,25 +109,25 @@ Depending on the role that's been granted to you, you can run basic or advanced The following commands are available for user roles that are granted the ability to run **basic** live response commands. For more information on role assignments, see [Create and manage roles](user-roles.md). -Command | Description -:---|:---|:--- -`cd` | Changes the current directory. -`cls` | Clears the console screen. -`connect` | Initiates a live response session to the device. -`connections` | Shows all the active connections. -`dir` | Shows a list of files and subdirectories in a directory -`download &` | Downloads a file in the background -drivers | Shows all drivers installed on the device. -`fg ` | Returns a file download to the foreground -`fileinfo` | Get information about a file. -`findfile` | Locates files by a given name on the device. -`help` | Provides help information for live response commands. -`persistence` | Shows all known persistence methods on the device. -`processes` | Shows all processes running on the device. -`registry` | Shows registry values. -`scheduledtasks` | Shows all scheduled tasks on the device. -`services` | Shows all services on the device. -`trace` | Sets the terminal's logging mode to debug. +| Command | Description | +|---|---|--- | +|`cd` | Changes the current directory. | +|`cls` | Clears the console screen. | +|`connect` | Initiates a live response session to the device. | +|`connections` | Shows all the active connections. | +|`dir` | Shows a list of files and subdirectories in a directory. | +|`download &` | Downloads a file in the background. | +drivers | Shows all drivers installed on the device. | +|`fg ` | Returns a file download to the foreground. | +|`fileinfo` | Get information about a file. | +|`findfile` | Locates files by a given name on the device. | +|`help` | Provides help information for live response commands. | +|`persistence` | Shows all known persistence methods on the device. | +|`processes` | Shows all processes running on the device. | +|`registry` | Shows registry values. | +|`scheduledtasks` | Shows all scheduled tasks on the device. | +|`services` | Shows all services on the device. | +|`trace` | Sets the terminal's logging mode to debug. | ### Advanced commands The following commands are available for user roles that are granted the ability to run **advanced** live response commands. For more information on role assignments see, [Create and manage roles](user-roles.md).
Enterprise Cloud Resources With proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
contoso.visualstudio.com,contoso.internalproxy2.com

Without proxy: contoso.sharepoint.com|contoso.visualstudio.com

Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don't use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can't tell whether it's attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.
Enterprise Network Domain Names (Required)
Proxy servers proxy.contoso.com:80;proxy2.contoso.com:443Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.

If you have multiple resources, you must separate them using the ";" delimiter.		Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources.

This list shouldn't include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.

If you have multiple resources, you must separate them using the ";" delimiter.
Internal proxy servers contoso.internalproxy1.com;contoso.internalproxy2.comSpecify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.

If you have multiple resources, you must separate them using the ";" delimiter.
Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources.

This list shouldn't include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.

If you have multiple resources, you must separate them using the ";" delimiter.
Enterprise IPv4 Range (Required) Starting IPv4 Address: 3.4.0.1
Ending IPv4 Address: 3.4.255.254
Custom URI: 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254		Create work documents in enterprise-allowed apps. For desktop:

For mobile:

    @@ -113,7 +113,7 @@ You can try any of the processes included in these scenarios, but you should foc
    1. Start Windows Journal and Internet Explorer 11, creating, editing, and saving files in both apps.
      Make sure that all of the files you worked with are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted.
    2. Open File Explorer and make sure your modified files are appearing with a Lock icon.
      3. -
    3. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.

      Note
      Most Windows-signed components like File Explorer (when running in the user’s context), should have access to enterprise data.

      A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.
      4. +
    4. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.

      Note
      Most Windows-signed components like File Explorer (when running in the user's context), should have access to enterprise data.

      A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.